Have anybody seen this--->23990098.$$$ ??

Hi again.

Another question.

I saw this strange to its name-file under C:/ . It holds the info below and
doesn't seem to be dangerous though, just strange name and extension on the
file.

"@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
rem - By Windows 98 Network - C:\WINDOWS\net start




@ECHO OFF
keyb sv,,C:\WINDOWS\COMMAND\keyboard.sys"

I wonder if each and every program installed on the PC who put its self
under the "run" command in win.ini have its own autoexec-file? Why I wonder
is because a Smiley installation wanted to put its self there but I took it
away. Later I discovered this 23990098.$$$ file when doing a search for
unwanted files and can also see that I have some 12 autoexec-files.

Four or five of them have the extension .bat and I can understand why they
are there but the rest have dos, 001, syd, _av, bak, app, nav and so this
in the subject line ($$$) who doesn't have the name autoexec but is looking
like one regarding to the text inside. Have no idea if it came with the
install of the program, it's just that I saw it first then.

Can I delete some of the autoexec-files, for example the bak-file? Or those
who holds command for program I have uninstalled? May I also say that I
have been searching Google and other places but can't find anything..it says
"your search did not match any documents" and can someone tell me how to do
a good search if wildcards and different wording is not enough!?

TIA and have a nice day. / Gunilla.



---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05

Haggis
Tue Dec 09 09:49:11 CST 2003

most programs that modify your autoexec.bat will make a backup of it ...when
you installed
Norton antivirus it made the backup autoexec.nav..etc.

if your current autoexec,bat work for you AND you don't want backup's then
delete them (I would suggest keeping at least one tho)


"Gunilla" <Gun@yahoo.com> wrote in message
news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...
> Hi again.
>
> Another question.
>
> I saw this strange to its name-file under C:/ . It holds the info below
and
> doesn't seem to be dangerous though, just strange name and extension on
the
> file.
>
> "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> rem - By Windows 98 Network - C:\WINDOWS\net start
>
>
>
>
> @ECHO OFF
> keyb sv,,C:\WINDOWS\COMMAND\keyboard.sys"
>
> I wonder if each and every program installed on the PC who put its self
> under the "run" command in win.ini have its own autoexec-file? Why I
wonder
> is because a Smiley installation wanted to put its self there but I took
it
> away. Later I discovered this 23990098.$$$ file when doing a search for
> unwanted files and can also see that I have some 12 autoexec-files.
>
> Four or five of them have the extension .bat and I can understand why they
> are there but the rest have dos, 001, syd, _av, bak, app, nav and so this
> in the subject line ($$$) who doesn't have the name autoexec but is
looking
> like one regarding to the text inside. Have no idea if it came with the
> install of the program, it's just that I saw it first then.
>
> Can I delete some of the autoexec-files, for example the bak-file? Or
those
> who holds command for program I have uninstalled? May I also say that I
> have been searching Google and other places but can't find anything..it
says
> "your search did not match any documents" and can someone tell me how to
do
> a good search if wildcards and different wording is not enough!?
>
> TIA and have a nice day. / Gunilla.
>
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05
>
>

Don
Tue Dec 09 09:57:46 CST 2003

"Gunilla" <Gun@yahoo.com> wrote in message
news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...

> I saw this strange to its name-file under C:/ . It holds the info below
and
> doesn't seem to be dangerous though, just strange name and extension on
the
> file.
>
> "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> rem - By Windows 98 Network - C:\WINDOWS\net start

This file is (a) probably a copy of an old AUTOEXEC.BAT
and (b) can probably be deleted safely. Filetype $$$ was
commonly used for temporary files that can be deleted
when their task is done.

The main point is that a standard Win98 installation
requires no AUTOEXEC.BAT and CONFIG.SYS.
You can experiment via MSCONFIG.EXE whether
these boot files are executed or not. (In most
installations they contain nothing but REM =
remark = non-functioning lines and DOS
instructions (e.g. to load KEYBOARD.SYS)
that Win98 either does not need or overrides.)

> I wonder if each and every program installed on the PC who put its self
> under the "run" command in win.ini have its own autoexec-file? Why I
wonder

No. Win98 handles this differently via
DOSSTART and its capacity to customize
settings for every DOS app you want to
run (via / Prooperties).

> I have some 12 autoexec-files.
>
> Four or five of them have the extension .bat and I can understand why they
> are there but the rest have dos, 001, syd, _av, bak, app, nav and so this

Left over by each app that, during installation
(1) wrote itself into AUTOEXEC.BAT and
(2) made first a copy of the old file in case
you needed it.

> Can I delete some of the autoexec-files, for example the bak-file?

Yes: delete any of these that is the same as
any of the others.

--
Don Phillipson
Carlsbad Springs (Ottawa, Canada)

Gunilla
Tue Dec 09 10:38:28 CST 2003

Okay Haggis. Thanks.

Yes, I have had Norton installed earlier and can see it is there in the
autoexec.nav file but that one I can delete then as Norton is uninstalled.
Maybe then it is the safest thing to save a backup as you suggest. Did you
understand why that last file is just named 23990098.$$$ and not
autoexec.(something) ?

Regards / Gunilla.

"Haggis" <bingsnapREMOVE@hotmail.com> wrote in message
news:RbmBb.17528$f7.835568@localhost...
> most programs that modify your autoexec.bat will make a backup of it
...when
> you installed
> Norton antivirus it made the backup autoexec.nav..etc.
>
> if your current autoexec,bat work for you AND you don't want backup's then
> delete them (I would suggest keeping at least one tho)
>
>
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...
> > Hi again.
> >
> > Another question.
> >
> > I saw this strange to its name-file under C:/ . It holds the info below
> and
> > doesn't seem to be dangerous though, just strange name and extension on
> the
> > file.
> >
> > "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> > rem - By Windows 98 Network - C:\WINDOWS\net start
> >
> >
> >
> >
> > @ECHO OFF
> > keyb sv,,C:\WINDOWS\COMMAND\keyboard.sys"
> >
> > I wonder if each and every program installed on the PC who put its self
> > under the "run" command in win.ini have its own autoexec-file? Why I
> wonder
> > is because a Smiley installation wanted to put its self there but I took
> it
> > away. Later I discovered this 23990098.$$$ file when doing a search for
> > unwanted files and can also see that I have some 12 autoexec-files.
> >
> > Four or five of them have the extension .bat and I can understand why
they
> > are there but the rest have dos, 001, syd, _av, bak, app, nav and so
this
> > in the subject line ($$$) who doesn't have the name autoexec but is
> looking
> > like one regarding to the text inside. Have no idea if it came with the
> > install of the program, it's just that I saw it first then.
> >
> > Can I delete some of the autoexec-files, for example the bak-file? Or
> those
> > who holds command for program I have uninstalled? May I also say that I
> > have been searching Google and other places but can't find anything..it
> says
> > "your search did not match any documents" and can someone tell me how to
> do
> > a good search if wildcards and different wording is not enough!?
> >
> > TIA and have a nice day. / Gunilla.
> >
> >
> >
> > ---
> > Outgoing mail is certified Virus Free.
> > Checked by AVG anti-virus system (http://www.grisoft.com).
> > Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05
> >
> >
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05

Haggis
Tue Dec 09 11:02:58 CST 2003

not exactly , but I have seen similar ones...
(something trying to replace your files and hide the org.)

you may want to run adaware or spybot to see if you've picked up some
unwanted malware


"Gunilla" <Gun@yahoo.com> wrote in message
news:O85ToLnvDHA.2080@TK2MSFTNGP10.phx.gbl...
> Okay Haggis. Thanks.
>
> Yes, I have had Norton installed earlier and can see it is there in the
> autoexec.nav file but that one I can delete then as Norton is uninstalled.
> Maybe then it is the safest thing to save a backup as you suggest. Did you
> understand why that last file is just named 23990098.$$$ and not
> autoexec.(something) ?
>
> Regards / Gunilla.
>
> "Haggis" <bingsnapREMOVE@hotmail.com> wrote in message
> news:RbmBb.17528$f7.835568@localhost...
> > most programs that modify your autoexec.bat will make a backup of it
> ...when
> > you installed
> > Norton antivirus it made the backup autoexec.nav..etc.
> >
> > if your current autoexec,bat work for you AND you don't want backup's
then
> > delete them (I would suggest keeping at least one tho)
> >
> >
> > "Gunilla" <Gun@yahoo.com> wrote in message
> > news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...
> > > Hi again.
> > >
> > > Another question.
> > >
> > > I saw this strange to its name-file under C:/ . It holds the info
below
> > and
> > > doesn't seem to be dangerous though, just strange name and extension
on
> > the
> > > file.
> > >
> > > "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> > > rem - By Windows 98 Network - C:\WINDOWS\net start
> > >
> > >
> > >
> > >
> > > @ECHO OFF
> > > keyb sv,,C:\WINDOWS\COMMAND\keyboard.sys"
> > >
> > > I wonder if each and every program installed on the PC who put its
self
> > > under the "run" command in win.ini have its own autoexec-file? Why I
> > wonder
> > > is because a Smiley installation wanted to put its self there but I
took
> > it
> > > away. Later I discovered this 23990098.$$$ file when doing a search
for
> > > unwanted files and can also see that I have some 12 autoexec-files.
> > >
> > > Four or five of them have the extension .bat and I can understand why
> they
> > > are there but the rest have dos, 001, syd, _av, bak, app, nav and so
> this
> > > in the subject line ($$$) who doesn't have the name autoexec but is
> > looking
> > > like one regarding to the text inside. Have no idea if it came with
the
> > > install of the program, it's just that I saw it first then.
> > >
> > > Can I delete some of the autoexec-files, for example the bak-file? Or
> > those
> > > who holds command for program I have uninstalled? May I also say that
I
> > > have been searching Google and other places but can't find
anything..it
> > says
> > > "your search did not match any documents" and can someone tell me how
to
> > do
> > > a good search if wildcards and different wording is not enough!?
> > >
> > > TIA and have a nice day. / Gunilla.
> > >
> > >
> > >
> > > ---
> > > Outgoing mail is certified Virus Free.
> > > Checked by AVG anti-virus system (http://www.grisoft.com).
> > > Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05
> > >
> > >
> >
> >
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05
>
>

Gunilla
Tue Dec 09 12:42:01 CST 2003

Thanks you so very much Don and Haggis.

Now I feel a little...or much... brighter about the meaning of
autoexec-files and their twins. Gosh so much there is to learn!

Take care and have a nice day to you both and rest until my next question!
;-))

Gunilla.

"Don Phillipson" <nospam@nospam.com> wrote in message
news:eMTnxGnvDHA.1760@TK2MSFTNGP10.phx.gbl...
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...
>
> > I saw this strange to its name-file under C:/ . It holds the info below
> and
> > doesn't seem to be dangerous though, just strange name and extension on
> the
> > file.
> >
> > "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> > rem - By Windows 98 Network - C:\WINDOWS\net start
>
> This file is (a) probably a copy of an old AUTOEXEC.BAT
> and (b) can probably be deleted safely. Filetype $$$ was
> commonly used for temporary files that can be deleted
> when their task is done.
>
> The main point is that a standard Win98 installation
> requires no AUTOEXEC.BAT and CONFIG.SYS.
> You can experiment via MSCONFIG.EXE whether
> these boot files are executed or not. (In most
> installations they contain nothing but REM =
> remark = non-functioning lines and DOS
> instructions (e.g. to load KEYBOARD.SYS)
> that Win98 either does not need or overrides.)
>
> > I wonder if each and every program installed on the PC who put its self
> > under the "run" command in win.ini have its own autoexec-file? Why I
> wonder
>
> No. Win98 handles this differently via
> DOSSTART and its capacity to customize
> settings for every DOS app you want to
> run (via / Prooperties).
>
> > I have some 12 autoexec-files.
> >
> > Four or five of them have the extension .bat and I can understand why
they
> > are there but the rest have dos, 001, syd, _av, bak, app, nav and so
this
>
> Left over by each app that, during installation
> (1) wrote itself into AUTOEXEC.BAT and
> (2) made first a copy of the old file in case
> you needed it.
>
> > Can I delete some of the autoexec-files, for example the bak-file?
>
> Yes: delete any of these that is the same as
> any of the others.
>
> --
> Don Phillipson
> Carlsbad Springs (Ottawa, Canada)
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05

Haggis
Tue Dec 09 13:15:24 CST 2003

you're welcome :>

"Gunilla" <Gun@yahoo.com> wrote in message
news:uFZHqQovDHA.2148@TK2MSFTNGP12.phx.gbl...
> Thanks you so very much Don and Haggis.
>
> Now I feel a little...or much... brighter about the meaning of
> autoexec-files and their twins. Gosh so much there is to learn!
>
> Take care and have a nice day to you both and rest until my next question!
> ;-))
>
> Gunilla.
>
> "Don Phillipson" <nospam@nospam.com> wrote in message
> news:eMTnxGnvDHA.1760@TK2MSFTNGP10.phx.gbl...
> > "Gunilla" <Gun@yahoo.com> wrote in message
> > news:euXAVpmvDHA.2000@TK2MSFTNGP11.phx.gbl...
> >
> > > I saw this strange to its name-file under C:/ . It holds the info
below
> > and
> > > doesn't seem to be dangerous though, just strange name and extension
on
> > the
> > > file.
> > >
> > > "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> > > rem - By Windows 98 Network - C:\WINDOWS\net start
> >
> > This file is (a) probably a copy of an old AUTOEXEC.BAT
> > and (b) can probably be deleted safely. Filetype $$$ was
> > commonly used for temporary files that can be deleted
> > when their task is done.
> >
> > The main point is that a standard Win98 installation
> > requires no AUTOEXEC.BAT and CONFIG.SYS.
> > You can experiment via MSCONFIG.EXE whether
> > these boot files are executed or not. (In most
> > installations they contain nothing but REM =
> > remark = non-functioning lines and DOS
> > instructions (e.g. to load KEYBOARD.SYS)
> > that Win98 either does not need or overrides.)
> >
> > > I wonder if each and every program installed on the PC who put its
self
> > > under the "run" command in win.ini have its own autoexec-file? Why I
> > wonder
> >
> > No. Win98 handles this differently via
> > DOSSTART and its capacity to customize
> > settings for every DOS app you want to
> > run (via / Prooperties).
> >
> > > I have some 12 autoexec-files.
> > >
> > > Four or five of them have the extension .bat and I can understand why
> they
> > > are there but the rest have dos, 001, syd, _av, bak, app, nav and so
> this
> >
> > Left over by each app that, during installation
> > (1) wrote itself into AUTOEXEC.BAT and
> > (2) made first a copy of the old file in case
> > you needed it.
> >
> > > Can I delete some of the autoexec-files, for example the bak-file?
> >
> > Yes: delete any of these that is the same as
> > any of the others.
> >
> > --
> > Don Phillipson
> > Carlsbad Springs (Ottawa, Canada)
> >
> >
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.548 / Virus Database: 341 - Release Date: 2003-12-05
>
>

cquirke
Thu Dec 11 21:33:22 CST 2003

On Tue, 9 Dec 2003 10:57:46 -0500, "Don Phillipson"
>"Gunilla" <Gun@yahoo.com> wrote in message

>> I saw this strange to its name-file under C:/ . It holds the info below

>> "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
>> rem - By Windows 98 Network - C:\WINDOWS\net start

>This file is (a) probably a copy of an old AUTOEXEC.BAT
>and (b) can probably be deleted safely. Filetype $$$ was
>commonly used for temporary files that can be deleted
>when their task is done.

True.

>> I wonder if each and every program installed on the PC who put its self
>> under the "run" command in win.ini have its own autoexec-file?

>No.

That negation is True.

>Win98 handles this differently via DOSSTART and its capacity
>to customize settings for every DOS app you want to run

False - that's not what DOSSTART.BAT is at all.

Properties of programs are stored in shortcuts; .pif for DOS programs
and .lnk for all other local files and objects.

DOSStart.bat is a single file in the Windows base directory and is
used for all .pif that are set to use the default form of exclusive
DOS mode ("Use with curent...").

DOSStart.bat is ignored by the more powerful "Specify a new...", which
does use custom Config.sys and Autoexec.bat for the program when it
runs in DOS mode. These files are copied out as .app, the existing
ones copied to .wos, then the .app are renamed over the active files
prior to shutdown and restart to put them and the DOS session they
define into effect. When done, the active files go back into the .pif
they came from, the .wos are renamed into active form, and the system
is rebooted to return ("exit") to Windows again.

In all cases, it is the actively-named files (C:\Config.sys,
C:\Autoexec.bat) that are in effect. All other relevant extensions
are "standby" forms that are not active until circumstances arise that
cause them to be renamed into action.

See http://users.iafrica.com/c/cq/cquirke/whatdos.htm

>> I have some 12 autoexec-files.

>> Four or five of them have the extension .bat and I can understand why they
>> are there but the rest have:

>> dos
Used for F8 menu "Previous version of MSDOS"; inactive in .dos form
>> app
Temporary form of "Specify a new..." .pif startup files
>> syd
Backup spawned after editing in SysEdit
>> bak
Backup spawned by editing in some old DOS apps
>> 001, _av,
Generic backups spawned by 3rd-party installers etc.
>Left over by each app that, during installation
Yes.

>> Can I delete some of the autoexec-files, for example the bak-file?

>Yes: delete any of these that is the same as
>any of the others.

Er, careful there! Don't delete...
.dos, .w40, .wos, .app, .bat
...as those do have system significance. Also, expect to find
alternate Autoexec.bat in other locations, e.g. %WinDir%\Command\EBD
that is used to populate any Emergency Boot Disks that you make.


>--------------- ----- ---- --- -- - - -
Error Messages Are Your Friends
>--------------- ----- ---- --- -- - - -

Gunilla
Fri Dec 12 12:14:30 CST 2003

Hi C.Quirke!

Thanks for all the explanations. So much there is yet to learn. Looked into
your webpage and while reading about all kind of DOS options my eyes fell on
the section where you are talking about "When is it not safe to run
Windows?" and especially about the "Malware" thing.

I have some big problem with my PC with errors all the time and other
symptoms and happen to see about "How to tell if a drive overlay program is
installed in Windows". According to that if you have less than 655,360 may
indicate the existence of a drive overlay program or a SCSI drive (whatever
that is?) or Master Boot Record Virus and I had just 635,312. Now I wonder
if you have any idea how I will continue with this info? I have AVG scan on
bootup and that is never showing anything. Is there an easy way to go
further in DOS to see what I actually have installed except for Dir /p ?

F-Disk /status didn't show anything unusual and Verifying Files like .bin
and .ovl-files show three .bin - Videorom.bin, Drvspace.bin and Dblspace.bin
and no .ovl even if a search in Windows show one .ovl which is a AVG-file. I
am not so good at the DOS command and couldn't even checking the
Config.sys-file...must have done something wrong.

Thanks for any input.

Kind regards / Gunilla.


"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:i1aitvsp8feokce22v4mv840tbbs5pfa2k@4ax.com...
> On Tue, 9 Dec 2003 10:57:46 -0500, "Don Phillipson"
> >"Gunilla" <Gun@yahoo.com> wrote in message
>
> >> I saw this strange to its name-file under C:/ . It holds the info below
>
> >> "@C:\PROGRAM\GRISOFT\AVG6\bootup.exe
> >> rem - By Windows 98 Network - C:\WINDOWS\net start
>
> >This file is (a) probably a copy of an old AUTOEXEC.BAT
> >and (b) can probably be deleted safely. Filetype $$$ was
> >commonly used for temporary files that can be deleted
> >when their task is done.
>
> True.
>
> >> I wonder if each and every program installed on the PC who put its self
> >> under the "run" command in win.ini have its own autoexec-file?
>
> >No.
>
> That negation is True.
>
> >Win98 handles this differently via DOSSTART and its capacity
> >to customize settings for every DOS app you want to run
>
> False - that's not what DOSSTART.BAT is at all.
>
> Properties of programs are stored in shortcuts; .pif for DOS programs
> and .lnk for all other local files and objects.
>
> DOSStart.bat is a single file in the Windows base directory and is
> used for all .pif that are set to use the default form of exclusive
> DOS mode ("Use with curent...").
>
> DOSStart.bat is ignored by the more powerful "Specify a new...", which
> does use custom Config.sys and Autoexec.bat for the program when it
> runs in DOS mode. These files are copied out as .app, the existing
> ones copied to .wos, then the .app are renamed over the active files
> prior to shutdown and restart to put them and the DOS session they
> define into effect. When done, the active files go back into the .pif
> they came from, the .wos are renamed into active form, and the system
> is rebooted to return ("exit") to Windows again.
>
> In all cases, it is the actively-named files (C:\Config.sys,
> C:\Autoexec.bat) that are in effect. All other relevant extensions
> are "standby" forms that are not active until circumstances arise that
> cause them to be renamed into action.
>
> See http://users.iafrica.com/c/cq/cquirke/whatdos.htm
>
> >> I have some 12 autoexec-files.
>
> >> Four or five of them have the extension .bat and I can understand why
they
> >> are there but the rest have:
>
> >> dos
> Used for F8 menu "Previous version of MSDOS"; inactive in .dos form
> >> app
> Temporary form of "Specify a new..." .pif startup files
> >> syd
> Backup spawned after editing in SysEdit
> >> bak
> Backup spawned by editing in some old DOS apps
> >> 001, _av,
> Generic backups spawned by 3rd-party installers etc.
> >Left over by each app that, during installation
> Yes.
>
> >> Can I delete some of the autoexec-files, for example the bak-file?
>
> >Yes: delete any of these that is the same as
> >any of the others.
>
> Er, careful there! Don't delete...
> .dos, .w40, .wos, .app, .bat
> ...as those do have system significance. Also, expect to find
> alternate Autoexec.bat in other locations, e.g. %WinDir%\Command\EBD
> that is used to populate any Emergency Boot Disks that you make.
>
>
> >--------------- ----- ---- --- -- - - -
> Error Messages Are Your Friends
> >--------------- ----- ---- --- -- - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

cquirke
Sat Dec 13 04:11:38 CST 2003

On Fri, 12 Dec 2003 19:14:30 +0100, "Gunilla" <Gun@yahoo.com> wrote:

>Hi C.Quirke!

Hi!

>...while reading about all kind of DOS options my eyes fell on
>the section where you are talking about "When is it not safe to run
>Windows?" and especially about the "Malware" thing.

Def! See http://users.iafrica.com/c/cq/cquirke/virtest.htm

>I have some big problem with my PC with errors all the time and other
>symptoms and happen to see about "How to tell if a drive overlay program is
>installed in Windows". According to that if you have less than 655,360 may
>indicate the existence of a drive overlay program or a SCSI drive (whatever
>that is?) or Master Boot Record Virus and I had just 635,312.

See also http://users.iafrica.com/c/cq/cquirke/doscompat.htm, as being
in DOS compatibility mode is a clearer indication of boot code malware
and incompatible DDO (some DDO are Win9x-compatible and OK)

>I have AVG scan on bootup and that is never showing anything.

OK; that's informal, so non-exclusionary. Well, it's formal enough
for Win32PE infectors (as they are Windows-dependent) but it doesn't
scan all the files on the HD, so non-exclusionary on that basis alone.

>Is there an easy way to go further in DOS to see what I actually
>have installed except for Dir /p ?

Well, there's DOS mode as per the "What DOS?" page you read, and there
are various Mem parameters (I use Mem /c/p - use Mem /? to see more)
as well as MSD.EXE (if you have it). But I'd do a formal virus check
to answer that question, rather than try and view RAM etc.

>F-Disk /status didn't show anything unusual and Verifying Files like .bin
>and .ovl-files show three .bin - Videorom.bin, Drvspace.bin and Dblspace.bin
>and no .ovl even if a search in Windows show one .ovl which is a AVG-file. I
>am not so good at the DOS command and couldn't even checking the
>Config.sys-file...must have done something wrong.

C:\Config.sys may not be present. Edit C:\Config.sys will bring up an
empty file whether there's no Config.sys or an empty Config.sys, so
it's better to do a Dir C:\Config.sys /A instead.

Dir /A is your friend - shows hidden and system files - but Dir /A /S
won't show contents of hidden or system directories, such as the
subdirs within C:\WINDOWS\TEMPOR~1\CONTENT.IE5 (web cache)

Unless you expect exposure to brand-new boot malware (like your
housemate is a malware coder or collector, for example), I'd use a
DOS-based av. Such software really does have value to add over trying
to figure this from first principles, though if you do have exposure
(that housemate, or you've picked a public-forum scrap with malware
coders as some of us in alt.comp.virus do) then that's all you have.

I'd heartily recommend F-Prot for DOS from www.f-prot.com; it's free
for personal use, which means you can get updates.

Free for evaluation is NOD32 for DOS from www.nod32.com, and that's a
highly compitent package in my limited experience with it.
Evaluation-only means you are honour-bound to stop using it after 25
days, and also means no updates!

Also free for evaluation is Sophos for DOS/Win3.yuk from
www.sophos.com; it's bigger than the others (5M+ download) but is a
true DOS av i.e. there's no Win3.yuk dependency, and it will run from
a RAM disk created by a diskette boot (my preferred approach; frees up
disketets for use on other PCs, and is way faster).

I had occasion to use all three yesterday, on a system infected with
Jeefo (a non-destructive Win32PE infector that is not new, but not all
that common either - first case I've seen). All three can identify
Jeefo, but none can clean it. I'm still beard-stroking on that one!



>-------------------- ----- ---- --- -- - - - -
Trsut me, I won't make a mistake!
>-------------------- ----- ---- --- -- - - - -

Gunilla
Sat Dec 13 05:51:28 CST 2003

Hi again.

Thank you, thank you for your answer! Forgot to tell that I have Win98 and
IE/OE 6.0 but anyhow, I am glad for all the information and links you
provided and I must investigate that at once! I did a scan with AVG rescue
set but it is probably better with a pure DOS AV. BTW I have F-Prot for DOS
but run it when still in Windows...is it maybe better to run it from DOS, I
mean by hitting Ctrl at boot-up and start with a DOS prompt directly?

May I ask...what is MSD.EXE? I did a search for it but could not find it. I
am the only one using this PC..no housemate here..so I am the only one who
is screwing up things. ;-)) Can I ask you one more thing...what is the
command for copy the text in DOS and later paste it in to for example
Notepad? Sorry, but I am just hopeless to know how to do. :-(

Thank you once again and have a nice day.

Gunilla.


"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:fpjltvcrscujeniniabjufn6edpt4tifs3@4ax.com...
> On Fri, 12 Dec 2003 19:14:30 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >Hi C.Quirke!
>
> Hi!
>
> >...while reading about all kind of DOS options my eyes fell on
> >the section where you are talking about "When is it not safe to run
> >Windows?" and especially about the "Malware" thing.
>
> Def! See http://users.iafrica.com/c/cq/cquirke/virtest.htm
>
> >I have some big problem with my PC with errors all the time and other
> >symptoms and happen to see about "How to tell if a drive overlay program
is
> >installed in Windows". According to that if you have less than 655,360
may
> >indicate the existence of a drive overlay program or a SCSI drive
(whatever
> >that is?) or Master Boot Record Virus and I had just 635,312.
>
> See also http://users.iafrica.com/c/cq/cquirke/doscompat.htm, as being
> in DOS compatibility mode is a clearer indication of boot code malware
> and incompatible DDO (some DDO are Win9x-compatible and OK)
>
> >I have AVG scan on bootup and that is never showing anything.
>
> OK; that's informal, so non-exclusionary. Well, it's formal enough
> for Win32PE infectors (as they are Windows-dependent) but it doesn't
> scan all the files on the HD, so non-exclusionary on that basis alone.
>
> >Is there an easy way to go further in DOS to see what I actually
> >have installed except for Dir /p ?
>
> Well, there's DOS mode as per the "What DOS?" page you read, and there
> are various Mem parameters (I use Mem /c/p - use Mem /? to see more)
> as well as MSD.EXE (if you have it). But I'd do a formal virus check
> to answer that question, rather than try and view RAM etc.
>
> >F-Disk /status didn't show anything unusual and Verifying Files like .bin
> >and .ovl-files show three .bin - Videorom.bin, Drvspace.bin and
Dblspace.bin
> >and no .ovl even if a search in Windows show one .ovl which is a
AVG-file. I
> >am not so good at the DOS command and couldn't even checking the
> >Config.sys-file...must have done something wrong.
>
> C:\Config.sys may not be present. Edit C:\Config.sys will bring up an
> empty file whether there's no Config.sys or an empty Config.sys, so
> it's better to do a Dir C:\Config.sys /A instead.
>
> Dir /A is your friend - shows hidden and system files - but Dir /A /S
> won't show contents of hidden or system directories, such as the
> subdirs within C:\WINDOWS\TEMPOR~1\CONTENT.IE5 (web cache)
>
> Unless you expect exposure to brand-new boot malware (like your
> housemate is a malware coder or collector, for example), I'd use a
> DOS-based av. Such software really does have value to add over trying
> to figure this from first principles, though if you do have exposure
> (that housemate, or you've picked a public-forum scrap with malware
> coders as some of us in alt.comp.virus do) then that's all you have.
>
> I'd heartily recommend F-Prot for DOS from www.f-prot.com; it's free
> for personal use, which means you can get updates.
>
> Free for evaluation is NOD32 for DOS from www.nod32.com, and that's a
> highly compitent package in my limited experience with it.
> Evaluation-only means you are honour-bound to stop using it after 25
> days, and also means no updates!
>
> Also free for evaluation is Sophos for DOS/Win3.yuk from
> www.sophos.com; it's bigger than the others (5M+ download) but is a
> true DOS av i.e. there's no Win3.yuk dependency, and it will run from
> a RAM disk created by a diskette boot (my preferred approach; frees up
> disketets for use on other PCs, and is way faster).
>
> I had occasion to use all three yesterday, on a system infected with
> Jeefo (a non-destructive Win32PE infector that is not new, but not all
> that common either - first case I've seen). All three can identify
> Jeefo, but none can clean it. I'm still beard-stroking on that one!
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Trsut me, I won't make a mistake!
> >-------------------- ----- ---- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

H
Sat Dec 13 07:33:26 CST 2003

MSD.EXE could be a DOS base application. If you did not install it then look
for a trojan/virus.
Check the list on this site.

START-UP APPLICATIONS
http://www.pacs-portal.co.uk/startup_index.htm
The complete list
http://www.pacs-portal.co.uk/startup_pages/startup_all.php


Keyboard Shortcuts for Windows
http://support.microsoft.com/?kbid=126449 (W95/98/se/ME 8/6/2002)

If you can you can highlight the text right click on the mouse, copy and
then open notepad and paste the text.
--

Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm


"Gunilla" <Gun@yahoo.com> wrote in message
news:eujw29WwDHA.536@tk2msftngp13.phx.gbl...
> Hi again.
>
> Thank you, thank you for your answer! Forgot to tell that I have Win98
and
> IE/OE 6.0 but anyhow, I am glad for all the information and links you
> provided and I must investigate that at once! I did a scan with AVG rescue
> set but it is probably better with a pure DOS AV. BTW I have F-Prot for
DOS
> but run it when still in Windows...is it maybe better to run it from DOS,
I
> mean by hitting Ctrl at boot-up and start with a DOS prompt directly?
>
> May I ask...what is MSD.EXE? I did a search for it but could not find it.
I
> am the only one using this PC..no housemate here..so I am the only one who
> is screwing up things. ;-)) Can I ask you one more thing...what is the
> command for copy the text in DOS and later paste it in to for example
> Notepad? Sorry, but I am just hopeless to know how to do. :-(
>
> Thank you once again and have a nice day.
>
> Gunilla.
>
>
> "cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
> news:fpjltvcrscujeniniabjufn6edpt4tifs3@4ax.com...
> > On Fri, 12 Dec 2003 19:14:30 +0100, "Gunilla" <Gun@yahoo.com> wrote:
> >
> > >Hi C.Quirke!
> >
> > Hi!
> >
> > >...while reading about all kind of DOS options my eyes fell on
> > >the section where you are talking about "When is it not safe to run
> > >Windows?" and especially about the "Malware" thing.
> >
> > Def! See http://users.iafrica.com/c/cq/cquirke/virtest.htm
> >
> > >I have some big problem with my PC with errors all the time and other
> > >symptoms and happen to see about "How to tell if a drive overlay
program
> is
> > >installed in Windows". According to that if you have less than 655,360
> may
> > >indicate the existence of a drive overlay program or a SCSI drive
> (whatever
> > >that is?) or Master Boot Record Virus and I had just 635,312.
> >
> > See also http://users.iafrica.com/c/cq/cquirke/doscompat.htm, as being
> > in DOS compatibility mode is a clearer indication of boot code malware
> > and incompatible DDO (some DDO are Win9x-compatible and OK)
> >
> > >I have AVG scan on bootup and that is never showing anything.
> >
> > OK; that's informal, so non-exclusionary. Well, it's formal enough
> > for Win32PE infectors (as they are Windows-dependent) but it doesn't
> > scan all the files on the HD, so non-exclusionary on that basis alone.
> >
> > >Is there an easy way to go further in DOS to see what I actually
> > >have installed except for Dir /p ?
> >
> > Well, there's DOS mode as per the "What DOS?" page you read, and there
> > are various Mem parameters (I use Mem /c/p - use Mem /? to see more)
> > as well as MSD.EXE (if you have it). But I'd do a formal virus check
> > to answer that question, rather than try and view RAM etc.
> >
> > >F-Disk /status didn't show anything unusual and Verifying Files like
.bin
> > >and .ovl-files show three .bin - Videorom.bin, Drvspace.bin and
> Dblspace.bin
> > >and no .ovl even if a search in Windows show one .ovl which is a
> AVG-file. I
> > >am not so good at the DOS command and couldn't even checking the
> > >Config.sys-file...must have done something wrong.
> >
> > C:\Config.sys may not be present. Edit C:\Config.sys will bring up an
> > empty file whether there's no Config.sys or an empty Config.sys, so
> > it's better to do a Dir C:\Config.sys /A instead.
> >
> > Dir /A is your friend - shows hidden and system files - but Dir /A /S
> > won't show contents of hidden or system directories, such as the
> > subdirs within C:\WINDOWS\TEMPOR~1\CONTENT.IE5 (web cache)
> >
> > Unless you expect exposure to brand-new boot malware (like your
> > housemate is a malware coder or collector, for example), I'd use a
> > DOS-based av. Such software really does have value to add over trying
> > to figure this from first principles, though if you do have exposure
> > (that housemate, or you've picked a public-forum scrap with malware
> > coders as some of us in alt.comp.virus do) then that's all you have.
> >
> > I'd heartily recommend F-Prot for DOS from www.f-prot.com; it's free
> > for personal use, which means you can get updates.
> >
> > Free for evaluation is NOD32 for DOS from www.nod32.com, and that's a
> > highly compitent package in my limited experience with it.
> > Evaluation-only means you are honour-bound to stop using it after 25
> > days, and also means no updates!
> >
> > Also free for evaluation is Sophos for DOS/Win3.yuk from
> > www.sophos.com; it's bigger than the others (5M+ download) but is a
> > true DOS av i.e. there's no Win3.yuk dependency, and it will run from
> > a RAM disk created by a diskette boot (my preferred approach; frees up
> > disketets for use on other PCs, and is way faster).
> >
> > I had occasion to use all three yesterday, on a system infected with
> > Jeefo (a non-destructive Win32PE infector that is not new, but not all
> > that common either - first case I've seen). All three can identify
> > Jeefo, but none can clean it. I'm still beard-stroking on that one!
> >
> >
> >
> > >-------------------- ----- ---- --- -- - - - -
> > Trsut me, I won't make a mistake!
> > >-------------------- ----- ---- --- -- - - - -
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
>
>

cquirke
Sat Dec 13 07:59:03 CST 2003

On Sat, 13 Dec 2003 12:51:28 +0100, "Gunilla" <Gun@yahoo.com> wrote:

>I did a scan with AVG rescue set

Never tried that, tho I have AVG on my system.

>but it is probably better with a pure DOS AV. BTW I have F-Prot for DOS
>but run it when still in Windows...is it maybe better to run it from DOS, I
>mean by hitting Ctrl at boot-up and start with a DOS prompt directly?

Yes, that would be good - and formal enough for malware that does not
go deeper than the Windows layer of abstraction. Code infectors that
infect DOS executables, .COM files or raw pre-filesystem boot code
would still be able to go active, so for those you'd need a boot that
runs no code off the HD at all.

>May I ask...what is MSD.EXE? I did a search for it but could not find it.

It's a utility from the DOS era, written by MS and shipping with some
MS products... not sure whether that was MS-DOS, Windows 3.1x or
others. Microsoft Diagnostics, it is called, and it's useful for some
system info tasks, though it doesn't test hardware for defects as such
(i.e. no RAM testing of testing for disk errors).

I use it mainly for seeing whether the UARTs (serial port controller
chips, or emulations thereof) are buffered or not - something that's
only relevant to really old PCs.

>Can I ask you one more thing...what is the command for copy
>the text in DOS and later paste it in to for example Notepad?

Only applies to Windows, really. Run your Command.com (or other DOS
application) in a window as opposed to full screen, and look for a
toolbar with Copy and Paste on it. You may have to fiddle with the
Properties of the .pif of DOS executable if this toolbar doesn't show.

From DOS, I'd use Edit to hilight and copy text, then paste that into
a New file within Edit, then SaveAs that file as wherever\whatever.



>-------------------- ----- ---- --- -- - - - -
Trsut me, I won't make a mistake!
>-------------------- ----- ---- --- -- - - - -

Gunilla
Sat Dec 13 08:40:13 CST 2003

Thank you so much both Henri and Cquirke for useful info.

I have to go into a scientist state about DOS commands and etc right NOW!
Ohh...this will be sooo interesting! *SMILE*

BTW..downloaded and installed Nod32, ran it also and came out clear but now
I will try it in DOS. ;-))

Cheers / Gunilla.

"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:ok4mtvc40sljpe3ju1kne5fsi394p2jrmo@4ax.com...
> On Sat, 13 Dec 2003 12:51:28 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >I did a scan with AVG rescue set
>
> Never tried that, tho I have AVG on my system.
>
> >but it is probably better with a pure DOS AV. BTW I have F-Prot for DOS
> >but run it when still in Windows...is it maybe better to run it from DOS,
I
> >mean by hitting Ctrl at boot-up and start with a DOS prompt directly?
>
> Yes, that would be good - and formal enough for malware that does not
> go deeper than the Windows layer of abstraction. Code infectors that
> infect DOS executables, .COM files or raw pre-filesystem boot code
> would still be able to go active, so for those you'd need a boot that
> runs no code off the HD at all.
>
> >May I ask...what is MSD.EXE? I did a search for it but could not find it.
>
> It's a utility from the DOS era, written by MS and shipping with some
> MS products... not sure whether that was MS-DOS, Windows 3.1x or
> others. Microsoft Diagnostics, it is called, and it's useful for some
> system info tasks, though it doesn't test hardware for defects as such
> (i.e. no RAM testing of testing for disk errors).
>
> I use it mainly for seeing whether the UARTs (serial port controller
> chips, or emulations thereof) are buffered or not - something that's
> only relevant to really old PCs.
>
> >Can I ask you one more thing...what is the command for copy
> >the text in DOS and later paste it in to for example Notepad?
>
> Only applies to Windows, really. Run your Command.com (or other DOS
> application) in a window as opposed to full screen, and look for a
> toolbar with Copy and Paste on it. You may have to fiddle with the
> Properties of the .pif of DOS executable if this toolbar doesn't show.
>
> From DOS, I'd use Edit to hilight and copy text, then paste that into
> a New file within Edit, then SaveAs that file as wherever\whatever.
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Trsut me, I won't make a mistake!
> >-------------------- ----- ---- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

LuckyStrike
Sat Dec 13 11:55:07 CST 2003

Hi Gunilla,

If you'd like to copy and paste the contents of a Dos Window into notepad,
try this once you have the Dos window contents of interest:
Click the box that has the dashed outline markings (called "Mark"), then
highlight the text in the Dos window, then click copy. Now you can paste the
selected text into Notepad.

HTH -
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------

"Gunilla" <Gun@yahoo.com> wrote in message
news:uGscJcYwDHA.1088@tk2msftngp13.phx.gbl...
> Thank you so much both Henri and Cquirke for useful info.
>
> I have to go into a scientist state about DOS commands and etc right NOW!
> Ohh...this will be sooo interesting! *SMILE*
>
> BTW..downloaded and installed Nod32, ran it also and came out clear but
now
> I will try it in DOS. ;-))
>
> Cheers / Gunilla.
>

Gunilla
Sat Dec 13 12:37:36 CST 2003

Thanks LuckyStrike...such a luck that you came by! ;-))

All the things...provided me...I tested have but no virus I found in in my
computers cave.
However, I know there is more to go, more to test and I do my best...I
really do.
In the world of DOS-commands I often gets lost..."win" my way out is what I
do the most.
Now I need to drink...some coffee while I think.
The next move I presume will be asking another question to thee! :-//

Cheers / Gunilla.

"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com> wrote in
message news:eYDaBJawDHA.3116@TK2MSFTNGP11.phx.gbl...
> Hi Gunilla,
>
> If you'd like to copy and paste the contents of a Dos Window into notepad,
> try this once you have the Dos window contents of interest:
> Click the box that has the dashed outline markings (called "Mark"), then
> highlight the text in the Dos window, then click copy. Now you can paste
the
> selected text into Notepad.
>
> HTH -
> --
>
> LuckyStrike
> LS@smokedamagedfurniture.youcandriveitawaytoday.com
> --------------------------------------------------------------------
>
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:uGscJcYwDHA.1088@tk2msftngp13.phx.gbl...
> > Thank you so much both Henri and Cquirke for useful info.
> >
> > I have to go into a scientist state about DOS commands and etc right
NOW!
> > Ohh...this will be sooo interesting! *SMILE*
> >
> > BTW..downloaded and installed Nod32, ran it also and came out clear but
> now
> > I will try it in DOS. ;-))
> >
> > Cheers / Gunilla.
> >
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

LuckyStrike
Sat Dec 13 13:41:33 CST 2003

OH...*Lucky* me! And *un-lucky* you. hehehe. Just keep it simple...real
simple. ;-))
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"Gunilla" <Gun@yahoo.com> wrote in message
news:e05OzgawDHA.1888@TK2MSFTNGP10.phx.gbl...
> Thanks LuckyStrike...such a luck that you came by! ;-))
>
> All the things...provided me...I tested have but no virus I found in in my
> computers cave.
> However, I know there is more to go, more to test and I do my best...I
> really do.
> In the world of DOS-commands I often gets lost..."win" my way out is what
I
> do the most.
> Now I need to drink...some coffee while I think.
> The next move I presume will be asking another question to thee! :-//
>
> Cheers / Gunilla.
>
> "LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com> wrote
in
> message news:eYDaBJawDHA.3116@TK2MSFTNGP11.phx.gbl...
> > Hi Gunilla,
> >
> > If you'd like to copy and paste the contents of a Dos Window into
notepad,
> > try this once you have the Dos window contents of interest:
> > Click the box that has the dashed outline markings (called "Mark"), then
> > highlight the text in the Dos window, then click copy. Now you can paste
> the
> > selected text into Notepad.
> >
> > HTH -
> > --
> >
> > LuckyStrike
> > LS@smokedamagedfurniture.youcandriveitawaytoday.com
> > --------------------------------------------------------------------

Gunilla
Sat Dec 13 17:47:19 CST 2003

It's okay LuckyStrike....I am just a simple girl , writing simple words.
Ohhh...it ain't easy. Nothing seems to please me...nothing I do it's working
the way I want. The living days for my PC I have started to count! Grrrrrrr.

Gunilla. :o((

"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com> wrote in
message news:OawAgEbwDHA.2528@TK2MSFTNGP10.phx.gbl...
> OH...*Lucky* me! And *un-lucky* you. hehehe. Just keep it simple...real
> simple. ;-))
> --
>
> LuckyStrike
> LS@smokedamagedfurniture.youcandriveitawaytoday.com
> --------------------------------------------------------------------
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:e05OzgawDHA.1888@TK2MSFTNGP10.phx.gbl...
> > Thanks LuckyStrike...such a luck that you came by! ;-))
> >
> > All the things...provided me...I tested have but no virus I found in in
my
> > computers cave.
> > However, I know there is more to go, more to test and I do my best...I
> > really do.
> > In the world of DOS-commands I often gets lost..."win" my way out is
what
> I
> > do the most.
> > Now I need to drink...some coffee while I think.
> > The next move I presume will be asking another question to thee! :-//
> >
> > Cheers / Gunilla.
> >
> > "LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote
> in
> > message news:eYDaBJawDHA.3116@TK2MSFTNGP11.phx.gbl...
> > > Hi Gunilla,
> > >
> > > If you'd like to copy and paste the contents of a Dos Window into
> notepad,
> > > try this once you have the Dos window contents of interest:
> > > Click the box that has the dashed outline markings (called "Mark"),
then
> > > highlight the text in the Dos window, then click copy. Now you can
paste
> > the
> > > selected text into Notepad.
> > >
> > > HTH -
> > > --
> > >
> > > LuckyStrike
> > > LS@smokedamagedfurniture.youcandriveitawaytoday.com
> > > --------------------------------------------------------------------
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

Gunilla
Sat Dec 13 18:02:49 CST 2003

Hello again.

Have to ask...when I try to run an .EXE-file in MS-DOS it says that there is
a fault in the .EXE-file! I can't run anything from there but if I try a
DOS- window in Windows I can do it. For example..I tried to run scandisk in
safe mode, after correcting dates of some .DBX-folders it started to run and
went up to 10% and then started over and over again, so I rebooted and tried
to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.

I have checked the .EXE in shell/open/command and it is ="%1" %* and that I
presume is right? I did something in Folder Options > File Types and that
was to check the Enable Quick View and Always Show Extension for the MS-DOS
commando-file. I hope I didn't do something wrong when doing that? Do you
have any ideas?

Regards / Gunilla.

"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:ok4mtvc40sljpe3ju1kne5fsi394p2jrmo@4ax.com...
> On Sat, 13 Dec 2003 12:51:28 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >I did a scan with AVG rescue set
>
> Never tried that, tho I have AVG on my system.
>
> >but it is probably better with a pure DOS AV. BTW I have F-Prot for DOS
> >but run it when still in Windows...is it maybe better to run it from DOS,
I
> >mean by hitting Ctrl at boot-up and start with a DOS prompt directly?
>
> Yes, that would be good - and formal enough for malware that does not
> go deeper than the Windows layer of abstraction. Code infectors that
> infect DOS executables, .COM files or raw pre-filesystem boot code
> would still be able to go active, so for those you'd need a boot that
> runs no code off the HD at all.
>
> >May I ask...what is MSD.EXE? I did a search for it but could not find it.
>
> It's a utility from the DOS era, written by MS and shipping with some
> MS products... not sure whether that was MS-DOS, Windows 3.1x or
> others. Microsoft Diagnostics, it is called, and it's useful for some
> system info tasks, though it doesn't test hardware for defects as such
> (i.e. no RAM testing of testing for disk errors).
>
> I use it mainly for seeing whether the UARTs (serial port controller
> chips, or emulations thereof) are buffered or not - something that's
> only relevant to really old PCs.
>
> >Can I ask you one more thing...what is the command for copy
> >the text in DOS and later paste it in to for example Notepad?
>
> Only applies to Windows, really. Run your Command.com (or other DOS
> application) in a window as opposed to full screen, and look for a
> toolbar with Copy and Paste on it. You may have to fiddle with the
> Properties of the .pif of DOS executable if this toolbar doesn't show.
>
> From DOS, I'd use Edit to hilight and copy text, then paste that into
> a New file within Edit, then SaveAs that file as wherever\whatever.
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Trsut me, I won't make a mistake!
> >-------------------- ----- ---- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

H
Sun Dec 14 07:55:33 CST 2003

If you closed you computer while it was running defrag then the program may
be corrupt.
Run SFC.EXE from the Start/Run applet and extract the file DEFRAG.EXE from
your Windows CD.

System File Checker explained
...hopefully in layman's terms.
http://users.westelcom.com/rogersr/sfc.htm

System File Checker explained
... in layman's terms.
http://support.earthlink.net/mu/1/psc/img/walkthroughs/windows_9x_nt/dialers/dun_1.3/0850.how.to.sfc.psc.html

If you run defrag make sure that your screen saver is off.
If you get this error message next time. Read the article now.
"Drive's Contents Have Changed: Restarting..." Message When You Use the Disk
Defragmenter Tool
http://support.microsoft.com/?kbid=186978

If and when you need information on DOS commands.
http://www.generation.net/~hleboeuf/doscomm7.htm


--

Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm



"Gunilla" <Gun@yahoo.com> wrote in message
news:uOVVgWdwDHA.3220@tk2msftngp13.phx.gbl...
> Hello again.
>
> Have to ask...when I try to run an .EXE-file in MS-DOS it says that there
is
> a fault in the .EXE-file! I can't run anything from there but if I try a
> DOS- window in Windows I can do it. For example..I tried to run scandisk
in
> safe mode, after correcting dates of some .DBX-folders it started to run
and
> went up to 10% and then started over and over again, so I rebooted and
tried
> to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.
>
> I have checked the .EXE in shell/open/command and it is ="%1" %* and that
I
> presume is right? I did something in Folder Options > File Types and that
> was to check the Enable Quick View and Always Show Extension for the
MS-DOS
> commando-file. I hope I didn't do something wrong when doing that? Do you
> have any ideas?
>
> Regards / Gunilla.
>
> "cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
> news:ok4mtvc40sljpe3ju1kne5fsi394p2jrmo@4ax.com...
> > On Sat, 13 Dec 2003 12:51:28 +0100, "Gunilla" <Gun@yahoo.com> wrote:
> >
> > >I did a scan with AVG rescue set
> >
> > Never tried that, tho I have AVG on my system.
> >
> > >but it is probably better with a pure DOS AV. BTW I have F-Prot for DOS
> > >but run it when still in Windows...is it maybe better to run it from
DOS,
> I
> > >mean by hitting Ctrl at boot-up and start with a DOS prompt directly?
> >
> > Yes, that would be good - and formal enough for malware that does not
> > go deeper than the Windows layer of abstraction. Code infectors that
> > infect DOS executables, .COM files or raw pre-filesystem boot code
> > would still be able to go active, so for those you'd need a boot that
> > runs no code off the HD at all.
> >
> > >May I ask...what is MSD.EXE? I did a search for it but could not find
it.
> >
> > It's a utility from the DOS era, written by MS and shipping with some
> > MS products... not sure whether that was MS-DOS, Windows 3.1x or
> > others. Microsoft Diagnostics, it is called, and it's useful for some
> > system info tasks, though it doesn't test hardware for defects as such
> > (i.e. no RAM testing of testing for disk errors).
> >
> > I use it mainly for seeing whether the UARTs (serial port controller
> > chips, or emulations thereof) are buffered or not - something that's
> > only relevant to really old PCs.
> >
> > >Can I ask you one more thing...what is the command for copy
> > >the text in DOS and later paste it in to for example Notepad?
> >
> > Only applies to Windows, really. Run your Command.com (or other DOS
> > application) in a window as opposed to full screen, and look for a
> > toolbar with Copy and Paste on it. You may have to fiddle with the
> > Properties of the .pif of DOS executable if this toolbar doesn't show.
> >
> > From DOS, I'd use Edit to hilight and copy text, then paste that into
> > a New file within Edit, then SaveAs that file as wherever\whatever.
> >
> >
> >
> > >-------------------- ----- ---- --- -- - - - -
> > Trsut me, I won't make a mistake!
> > >-------------------- ----- ---- --- -- - - - -
>
>
> ---
> Outgoing mail is certified Virus Free.
> Checked by AVG anti-virus system (http://www.grisoft.com).
> Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
>
>

cquirke
Sun Dec 14 09:10:07 CST 2003

On Sun, 14 Dec 2003 01:02:49 +0100, "Gunilla" <Gun@yahoo.com> wrote:

>Have to ask...when I try to run an .EXE-file in MS-DOS it says that there is
>a fault in the .EXE-file! I can't run anything from there but if I try a
>DOS- window in Windows I can do it. For example..I tried to run scandisk in
>safe mode, after correcting dates of some .DBX-folders it started to run and
>went up to 10% and then started over and over again, so I rebooted and tried
>to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.

Any particular .exe file, or all?
Do genuine .com files work OK?
Does renaming to .com help?
Is Windows running in DOS Compatibility Mode?

.COM files are 64k images that are just splatted into RAM and run -
whereas .EXE files contain "fixup" values that DOS uses to allocate
separate code, data and stack segments to program before entering it.

If something goes wring with DOS's ability to do that (say, virus
patched into the process, or virus-damaged .EXE having invalid values,
or file system / geometry errors causung garbage fixup data) then etc.

DOS 7 looks for header info to distinguish .EXE from .COM when running
programs, disregarding the file name extension; that's why you can
rename an .EXE to .COM or vice versa, and it works, whereas in older
MS-DOS you'd expect ".COM" to crash and ".EXE" to give an error about
invalid pointers, program too big (bad fixup values) or crash.

If renaming a .COM to .EXE stops the .COM from working, and renaming
an .EXE to .COM causes it to stop failing and work, then there's
something specifically wrong with .EXE handling per se. In Windows,
that would suggest file association issues (malware patch in) but that
doesn't apply in DOS mode - in fact, I can't think of what would,
other than a handful of bytes within Command.com, or perhaps s virus
that has patched into the "what to do with this file" logic.

If OTOH .EXE files always crash whether the extension is .EXE or .COM,
and .COM always work even if renamed .EXE, then it's something to do
with the memory management of .EXE code. The distiction is
interesting, but not really helpful; either way you'd want to do a
formal virus check, and version-check and FC-check IO.SYS,
Command.com, and perhaps the memory and file system managers
HiMem.sys, Emm386.exe and IFSHlp.sys

You can also try renaming away Config.sys and Autoexec.bat, and
checking RAM for errors (tho I'd expect Windows to have become a pain
in the butt if RAM was bad)

>I have checked the .EXE in shell/open/command and it is ="%1" %* and that I
>presume is right?

It's right, but irrelevant in pure DOS mode (one of the advantages of
DOS mode when it comes to manual malware cleanup)

>I did something in Folder Options > File Types and that was to check the
>Enable Quick View and Always Show Extension for the MS-DOS
>commando-file. I hope I didn't do something wrong when doing that?

Sounds OK



>-------------------- ----- ---- --- -- - - - -
Trsut me, I won't make a mistake!
>-------------------- ----- ---- --- -- - - - -

Gunilla
Sun Dec 14 12:12:37 CST 2003

Hi again and thanks.

I have been messing around in DOS and found out that I could run scandisk if
I typed C:\Windows\Command and ran it from there. The other option to run it
from C:\Windows did not work as the fault in .EXE file showed up. Have not
tried to rename to .COM yet because I wanted to show you something that
might be of importance. BTW..scandisk corrected TVDebug.log as it was wrong
size and some cluster-fault that it saved as a file0001.chk in the root but
I don't know how to read it as Type didn't open it.

Today I tried to do another bootscan with Trend Micros Rescue Set and it all
went out well until the last diskette had been running for a while. It
couldn't continue as it was a error (exception...general protection fault).
I could not save it to a file as I dont know how to do it in DOS but I wrote
it down.

DOS/4GW error (2001): exception 0DH (general protection fault) at
1D0:002F43FF
TSF32:prev_tsf32 5380
ss 1D8 DS 1D8 1D8 FS
0 GS 20
EAX FFFFFFFF EBX 344D38 ECX 0 EDX 7FFF
ESI 7FFF EDI C35D EBP D7E8126 ESP 344C38
CS:IP 100:002F43FF ID 00 COD 0 FLG 10212
CS= 1D0, USE32, page granular, limilt FFFFFFFF, base
0, acc CF9B
SS= 1D8, USE32, page granular, limit FFFFFFFF, base
0, acc CF93
DS= 1D8, USE32, page granular, limit FFFFFFFF, base
0, acc CF93
ES= 1D8, USE32, page granular, limit FFFFFFFF, base
0, acc CF93
FS= 0, USE16, byte granular, limit 0, base
14, acc 0
GS= 20, USE16, byte granular, limit FFFF, base
31140, acc 93
CR0: PG:0 ET:1 TS:0 EM:0 MP:0 PE:1 CR2:0 CR3:0
crash address (unrecolated) = 1:000833FF

Okay, I send this now and hope you or someone else know how to interpret
this. BTW..those errors I have refeer to Explorer.exe exceptions in
c06d007eH in module SENS.DLL on address 015f:6010857f. and also EXPLORER
caused an invalid page fault in module KERNEL32.DLL on address 015f:bff7b9e6
and MSIMN caused an invalid page fault in
module MSHTMLED.DLL on address 015f:70f72931. This happens every time I
connect to internet, even if it is 10 times each day!! I though it might be
to help if I provide this info.

Ohhh, one more thing...have just attached more RAM (128 MB now). Did run two
memory tests, Windows Test utility and MemTest and yes, even DocMem and I
seems to be clear, or fine.

BTW..have already scanned for Win95.Matrix virus and tried all things from
reinstallation of IE and OE, running SFC, removed my Network applications in
both the Control Panel and in the registry to rebuild it again and nothing
worked.

Sorry for the huge post! ;-))





"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:oduotvcnau3m2u7g1kb1ndsu68vbm6jj79@4ax.com...
> On Sun, 14 Dec 2003 01:02:49 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >Have to ask...when I try to run an .EXE-file in MS-DOS it says that there
is
> >a fault in the .EXE-file! I can't run anything from there but if I try a
> >DOS- window in Windows I can do it. For example..I tried to run scandisk
in
> >safe mode, after correcting dates of some .DBX-folders it started to run
and
> >went up to 10% and then started over and over again, so I rebooted and
tried
> >to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.
>
> Any particular .exe file, or all?
> Do genuine .com files work OK?
> Does renaming to .com help?
> Is Windows running in DOS Compatibility Mode?
>
> .COM files are 64k images that are just splatted into RAM and run -
> whereas .EXE files contain "fixup" values that DOS uses to allocate
> separate code, data and stack segments to program before entering it.
>
> If something goes wring with DOS's ability to do that (say, virus
> patched into the process, or virus-damaged .EXE having invalid values,
> or file system / geometry errors causung garbage fixup data) then etc.
>
> DOS 7 looks for header info to distinguish .EXE from .COM when running
> programs, disregarding the file name extension; that's why you can
> rename an .EXE to .COM or vice versa, and it works, whereas in older
> MS-DOS you'd expect ".COM" to crash and ".EXE" to give an error about
> invalid pointers, program too big (bad fixup values) or crash.
>
> If renaming a .COM to .EXE stops the .COM from working, and renaming
> an .EXE to .COM causes it to stop failing and work, then there's
> something specifically wrong with .EXE handling per se. In Windows,
> that would suggest file association issues (malware patch in) but that
> doesn't apply in DOS mode - in fact, I can't think of what would,
> other than a handful of bytes within Command.com, or perhaps s virus
> that has patched into the "what to do with this file" logic.
>
> If OTOH .EXE files always crash whether the extension is .EXE or .COM,
> and .COM always work even if renamed .EXE, then it's something to do
> with the memory management of .EXE code. The distiction is
> interesting, but not really helpful; either way you'd want to do a
> formal virus check, and version-check and FC-check IO.SYS,
> Command.com, and perhaps the memory and file system managers
> HiMem.sys, Emm386.exe and IFSHlp.sys
>
> You can also try renaming away Config.sys and Autoexec.bat, and
> checking RAM for errors (tho I'd expect Windows to have become a pain
> in the butt if RAM was bad)
>
> >I have checked the .EXE in shell/open/command and it is ="%1" %* and that
I
> >presume is right?
>
> It's right, but irrelevant in pure DOS mode (one of the advantages of
> DOS mode when it comes to manual malware cleanup)
>
> >I did something in Folder Options > File Types and that was to check the
> >Enable Quick View and Always Show Extension for the MS-DOS
> >commando-file. I hope I didn't do something wrong when doing that?
>
> Sounds OK
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Trsut me, I won't make a mistake!
> >-------------------- ----- ---- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

Gunilla
Sun Dec 14 12:26:52 CST 2003

Forgot to ask...how do I see if Windows is running in DOS Compatibility
Mode? I can't see it in the System Manager under any tab. Also....Thank you
for all.

Gunilla.

"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:oduotvcnau3m2u7g1kb1ndsu68vbm6jj79@4ax.com...
> On Sun, 14 Dec 2003 01:02:49 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >Have to ask...when I try to run an .EXE-file in MS-DOS it says that there
is
> >a fault in the .EXE-file! I can't run anything from there but if I try a
> >DOS- window in Windows I can do it. For example..I tried to run scandisk
in
> >safe mode, after correcting dates of some .DBX-folders it started to run
and
> >went up to 10% and then started over and over again, so I rebooted and
tried
> >to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.
>
> Any particular .exe file, or all?
> Do genuine .com files work OK?
> Does renaming to .com help?
> Is Windows running in DOS Compatibility Mode?
>
> .COM files are 64k images that are just splatted into RAM and run -
> whereas .EXE files contain "fixup" values that DOS uses to allocate
> separate code, data and stack segments to program before entering it.
>
> If something goes wring with DOS's ability to do that (say, virus
> patched into the process, or virus-damaged .EXE having invalid values,
> or file system / geometry errors causung garbage fixup data) then etc.
>
> DOS 7 looks for header info to distinguish .EXE from .COM when running
> programs, disregarding the file name extension; that's why you can
> rename an .EXE to .COM or vice versa, and it works, whereas in older
> MS-DOS you'd expect ".COM" to crash and ".EXE" to give an error about
> invalid pointers, program too big (bad fixup values) or crash.
>
> If renaming a .COM to .EXE stops the .COM from working, and renaming
> an .EXE to .COM causes it to stop failing and work, then there's
> something specifically wrong with .EXE handling per se. In Windows,
> that would suggest file association issues (malware patch in) but that
> doesn't apply in DOS mode - in fact, I can't think of what would,
> other than a handful of bytes within Command.com, or perhaps s virus
> that has patched into the "what to do with this file" logic.
>
> If OTOH .EXE files always crash whether the extension is .EXE or .COM,
> and .COM always work even if renamed .EXE, then it's something to do
> with the memory management of .EXE code. The distiction is
> interesting, but not really helpful; either way you'd want to do a
> formal virus check, and version-check and FC-check IO.SYS,
> Command.com, and perhaps the memory and file system managers
> HiMem.sys, Emm386.exe and IFSHlp.sys
>
> You can also try renaming away Config.sys and Autoexec.bat, and
> checking RAM for errors (tho I'd expect Windows to have become a pain
> in the butt if RAM was bad)
>
> >I have checked the .EXE in shell/open/command and it is ="%1" %* and that
I
> >presume is right?
>
> It's right, but irrelevant in pure DOS mode (one of the advantages of
> DOS mode when it comes to manual malware cleanup)
>
> >I did something in Folder Options > File Types and that was to check the
> >Enable Quick View and Always Show Extension for the MS-DOS
> >commando-file. I hope I didn't do something wrong when doing that?
>
> Sounds OK
>
>
>
> >-------------------- ----- ---- --- -- - - - -
> Trsut me, I won't make a mistake!
> >-------------------- ----- ---- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

LuckyStrike
Sun Dec 14 13:14:05 CST 2003

Thanks for the reassurances Gunilla, as I'm a simple country fellow as well.
Anyway, welcome to "The Club"; It is common for things to have a mind of
their own, but be careful in choosing the means of "Re-Booting" the PC. At
least warn it that you will teach it a whole new meaning of the word
"Re-Boot" if it doesn't shape up in a hurry. :-))
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------

"Gunilla" <Gun@yahoo.com> wrote in message
news:OXVB2NdwDHA.1680@TK2MSFTNGP12.phx.gbl...
> It's okay LuckyStrike....I am just a simple girl , writing simple words.
> Ohhh...it ain't easy. Nothing seems to please me...nothing I do it's
working
> the way I want. The living days for my PC I have started to count!
Grrrrrrr.
>
> Gunilla. :o((
>

Gunilla
Sun Dec 14 14:21:13 CST 2003

Yea..thanks LuckyStrike for the advice. If I'm not mistaken I have a perfect
boot somewhere in a closet that will that will teach this PC one thing or
another! ;-))

G.

"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com> wrote in
message news:O9Sk0ZnwDHA.3116@TK2MSFTNGP11.phx.gbl...
> Thanks for the reassurances Gunilla, as I'm a simple country fellow as
well.
> Anyway, welcome to "The Club"; It is common for things to have a mind of
> their own, but be careful in choosing the means of "Re-Booting" the PC. At
> least warn it that you will teach it a whole new meaning of the word
> "Re-Boot" if it doesn't shape up in a hurry. :-))
> --
>
> LuckyStrike
> LS@smokedamagedfurniture.youcandriveitawaytoday.com
> --------------------------------------------------------------------
>
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:OXVB2NdwDHA.1680@TK2MSFTNGP12.phx.gbl...
> > It's okay LuckyStrike....I am just a simple girl , writing simple words.
> > Ohhh...it ain't easy. Nothing seems to please me...nothing I do it's
> working
> > the way I want. The living days for my PC I have started to count!
> Grrrrrrr.
> >
> > Gunilla. :o((
> >
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

LuckyStrike
Sun Dec 14 14:57:06 CST 2003

Heh! LOL! I have a couple of extra one's also. Hmmmm....that's funny... I
have a lot of boots around, but oddly enough not one "Pair"! I wonder where
the other half of them have disappeared to? ;-D
--
LS
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"Gunilla" <Gun@yahoo.com> wrote in message
news:eGHwW$nwDHA.1576@TK2MSFTNGP11.phx.gbl...
> Yea..thanks LuckyStrike for the advice. If I'm not mistaken I have a
perfect
> boot somewhere in a closet that will that will teach this PC one thing or
> another! ;-))
>
> G.
>

PCR
Sun Dec 14 15:29:53 CST 2003

"Control Panel, System, Performance tab". If it says, "Your system is
configured for optimal performance", then you are fine. You are not in
"Compatibility Mode".

It should look just like that in Normal Mode. (In Safe Mode, it is
natural for it to be a bit ugly in that tab.)

I have no intention of staying in this thread, though. Stick with
cquirke!

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Gunilla" <Gun@yahoo.com> wrote in message
news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
| Forgot to ask...how do I see if Windows is running in DOS
Compatibility
| Mode? I can't see it in the System Manager under any tab.
Also....Thank you
| for all.
|
| Gunilla.
|
| "cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in
message
| news:oduotvcnau3m2u7g1kb1ndsu68vbm6jj79@4ax.com...
| > On Sun, 14 Dec 2003 01:02:49 +0100, "Gunilla" <Gun@yahoo.com> wrote:
| >
| > >Have to ask...when I try to run an .EXE-file in MS-DOS it says that
there
| is
| > >a fault in the .EXE-file! I can't run anything from there but if I
try a
| > >DOS- window in Windows I can do it. For example..I tried to run
scandisk
| in
| > >safe mode, after correcting dates of some .DBX-folders it started
to run
| and
| > >went up to 10% and then started over and over again, so I rebooted
and
| tried
| > >to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.
| >
| > Any particular .exe file, or all?
| > Do genuine .com files work OK?
| > Does renaming to .com help?
| > Is Windows running in DOS Compatibility Mode?
| >
| > .COM files are 64k images that are just splatted into RAM and run -
| > whereas .EXE files contain "fixup" values that DOS uses to allocate
| > separate code, data and stack segments to program before entering
it.
| >
| > If something goes wring with DOS's ability to do that (say, virus
| > patched into the process, or virus-damaged .EXE having invalid
values,
| > or file system / geometry errors causung garbage fixup data) then
etc.
| >
| > DOS 7 looks for header info to distinguish .EXE from .COM when
running
| > programs, disregarding the file name extension; that's why you can
| > rename an .EXE to .COM or vice versa, and it works, whereas in older
| > MS-DOS you'd expect ".COM" to crash and ".EXE" to give an error
about
| > invalid pointers, program too big (bad fixup values) or crash.
| >
| > If renaming a .COM to .EXE stops the .COM from working, and renaming
| > an .EXE to .COM causes it to stop failing and work, then there's
| > something specifically wrong with .EXE handling per se. In Windows,
| > that would suggest file association issues (malware patch in) but
that
| > doesn't apply in DOS mode - in fact, I can't think of what would,
| > other than a handful of bytes within Command.com, or perhaps s virus
| > that has patched into the "what to do with this file" logic.
| >
| > If OTOH .EXE files always crash whether the extension is .EXE or
.COM,
| > and .COM always work even if renamed .EXE, then it's something to do
| > with the memory management of .EXE code. The distiction is
| > interesting, but not really helpful; either way you'd want to do a
| > formal virus check, and version-check and FC-check IO.SYS,
| > Command.com, and perhaps the memory and file system managers
| > HiMem.sys, Emm386.exe and IFSHlp.sys
| >
| > You can also try renaming away Config.sys and Autoexec.bat, and
| > checking RAM for errors (tho I'd expect Windows to have become a
pain
| > in the butt if RAM was bad)
| >
| > >I have checked the .EXE in shell/open/command and it is ="%1" %*
and that
| I
| > >presume is right?
| >
| > It's right, but irrelevant in pure DOS mode (one of the advantages
of
| > DOS mode when it comes to manual malware cleanup)
| >
| > >I did something in Folder Options > File Types and that was to
check the
| > >Enable Quick View and Always Show Extension for the MS-DOS
| > >commando-file. I hope I didn't do something wrong when doing that?
| >
| > Sounds OK
| >
| >
| >
| > >-------------------- ----- ---- --- -- - - - -
| > Trsut me, I won't make a mistake!
| > >-------------------- ----- ---- --- -- - - - -
|
|
| ---
| Outgoing mail is certified Virus Free.
| Checked by AVG anti-virus system (http://www.grisoft.com).
| Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
|
|

Gunilla
Sun Dec 14 16:01:41 CST 2003

Hi PCR.

Thanks for the info. I am then not in a Compatibility Mode! So nice!
But Hey...why don't you stay? It's nice to be surrounded by so many nice
people! ;-))

Gunilla.

"PCR" <pcrrcp@netzero.net> wrote in message
news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
> "Control Panel, System, Performance tab". If it says, "Your system is
> configured for optimal performance", then you are fine. You are not in
> "Compatibility Mode".
>
> It should look just like that in Normal Mode. (In Safe Mode, it is
> natural for it to be a bit ugly in that tab.)
>
> I have no intention of staying in this thread, though. Stick with
> cquirke!
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
> | Forgot to ask...how do I see if Windows is running in DOS
> Compatibility
> | Mode? I can't see it in the System Manager under any tab.
> Also....Thank you
> | for all.
> |
> | Gunilla.
> |
> | "cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in
> message
> | news:oduotvcnau3m2u7g1kb1ndsu68vbm6jj79@4ax.com...
> | > On Sun, 14 Dec 2003 01:02:49 +0100, "Gunilla" <Gun@yahoo.com> wrote:
> | >
> | > >Have to ask...when I try to run an .EXE-file in MS-DOS it says that
> there
> | is
> | > >a fault in the .EXE-file! I can't run anything from there but if I
> try a
> | > >DOS- window in Windows I can do it. For example..I tried to run
> scandisk
> | in
> | > >safe mode, after correcting dates of some .DBX-folders it started
> to run
> | and
> | > >went up to 10% and then started over and over again, so I rebooted
> and
> | tried
> | > >to run in MS-DOS Prompt Only and then I got the fault in .EXE-file.
> | >
> | > Any particular .exe file, or all?
> | > Do genuine .com files work OK?
> | > Does renaming to .com help?
> | > Is Windows running in DOS Compatibility Mode?
> | >
> | > .COM files are 64k images that are just splatted into RAM and run -
> | > whereas .EXE files contain "fixup" values that DOS uses to allocate
> | > separate code, data and stack segments to program before entering
> it.
> | >
> | > If something goes wring with DOS's ability to do that (say, virus
> | > patched into the process, or virus-damaged .EXE having invalid
> values,
> | > or file system / geometry errors causung garbage fixup data) then
> etc.
> | >
> | > DOS 7 looks for header info to distinguish .EXE from .COM when
> running
> | > programs, disregarding the file name extension; that's why you can
> | > rename an .EXE to .COM or vice versa, and it works, whereas in older
> | > MS-DOS you'd expect ".COM" to crash and ".EXE" to give an error
> about
> | > invalid pointers, program too big (bad fixup values) or crash.
> | >
> | > If renaming a .COM to .EXE stops the .COM from working, and renaming
> | > an .EXE to .COM causes it to stop failing and work, then there's
> | > something specifically wrong with .EXE handling per se. In Windows,
> | > that would suggest file association issues (malware patch in) but
> that
> | > doesn't apply in DOS mode - in fact, I can't think of what would,
> | > other than a handful of bytes within Command.com, or perhaps s virus
> | > that has patched into the "what to do with this file" logic.
> | >
> | > If OTOH .EXE files always crash whether the extension is .EXE or
> .COM,
> | > and .COM always work even if renamed .EXE, then it's something to do
> | > with the memory management of .EXE code. The distiction is
> | > interesting, but not really helpful; either way you'd want to do a
> | > formal virus check, and version-check and FC-check IO.SYS,
> | > Command.com, and perhaps the memory and file system managers
> | > HiMem.sys, Emm386.exe and IFSHlp.sys
> | >
> | > You can also try renaming away Config.sys and Autoexec.bat, and
> | > checking RAM for errors (tho I'd expect Windows to have become a
> pain
> | > in the butt if RAM was bad)
> | >
> | > >I have checked the .EXE in shell/open/command and it is ="%1" %*
> and that
> | I
> | > >presume is right?
> | >
> | > It's right, but irrelevant in pure DOS mode (one of the advantages
> of
> | > DOS mode when it comes to manual malware cleanup)
> | >
> | > >I did something in Folder Options > File Types and that was to
> check the
> | > >Enable Quick View and Always Show Extension for the MS-DOS
> | > >commando-file. I hope I didn't do something wrong when doing that?
> | >
> | > Sounds OK
> | >
> | >
> | >
> | > >-------------------- ----- ---- --- -- - - - -
> | > Trsut me, I won't make a mistake!
> | > >-------------------- ----- ---- --- -- - - - -
> |
> |
> | ---
> | Outgoing mail is certified Virus Free.
> | Checked by AVG anti-virus system (http://www.grisoft.com).
> | Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
> |
> |
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

PCR
Sun Dec 14 17:21:53 CST 2003

OK, OK, I'm still here. But I'm leaving this thread for LuckyStrike to
train in. I think you two are getting close to matching boots, to see
whether you can find a pair. That could be a good a first step! But you
will be barefoot until then; so, careful! Also, I am sure cquirke will
be back.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Gunilla" <Gun@yahoo.com> wrote in message
news:uePCg3owDHA.2712@TK2MSFTNGP11.phx.gbl...
| Hi PCR.
|
| Thanks for the info. I am then not in a Compatibility Mode! So nice!
| But Hey...why don't you stay? It's nice to be surrounded by so many
nice
| people! ;-))
|
| Gunilla.
|
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
| > "Control Panel, System, Performance tab". If it says, "Your system
is
| > configured for optimal performance", then you are fine. You are not
in
| > "Compatibility Mode".
| >
| > It should look just like that in Normal Mode. (In Safe Mode, it is
| > natural for it to be a bit ugly in that tab.)
| >
| > I have no intention of staying in this thread, though. Stick with
| > cquirke!
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "Gunilla" <Gun@yahoo.com> wrote in message
| > news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
| > | Forgot to ask...how do I see if Windows is running in DOS
| > Compatibility
| > | Mode? I can't see it in the System Manager under any tab.
| > Also....Thank you
| > | for all.
| > |
| > | Gunilla.
...snip

Gunilla
Sun Dec 14 17:57:38 CST 2003

Hahaha...so funny you are PCR! ;-))

G.

"PCR" <pcrrcp@netzero.net> wrote in message
news:uTjNpjpwDHA.536@tk2msftngp13.phx.gbl...
> OK, OK, I'm still here. But I'm leaving this thread for LuckyStrike to
> train in. I think you two are getting close to matching boots, to see
> whether you can find a pair. That could be a good a first step! But you
> will be barefoot until then; so, careful! Also, I am sure cquirke will
> be back.
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:uePCg3owDHA.2712@TK2MSFTNGP11.phx.gbl...
> | Hi PCR.
> |
> | Thanks for the info. I am then not in a Compatibility Mode! So nice!
> | But Hey...why don't you stay? It's nice to be surrounded by so many
> nice
> | people! ;-))
> |
> | Gunilla.
> |
> | "PCR" <pcrrcp@netzero.net> wrote in message
> | news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
> | > "Control Panel, System, Performance tab". If it says, "Your system
> is
> | > configured for optimal performance", then you are fine. You are not
> in
> | > "Compatibility Mode".
> | >
> | > It should look just like that in Normal Mode. (In Safe Mode, it is
> | > natural for it to be a bit ugly in that tab.)
> | >
> | > I have no intention of staying in this thread, though. Stick with
> | > cquirke!
> | >
> | > --
> | > Thanks or Good Luck,
> | > There may be humor in this post, and,
> | > Naturally, you will not sue,
> | > should things get worse after this,
> | > PCR
> | > pcrrcp@netzero.net
> | > "Gunilla" <Gun@yahoo.com> wrote in message
> | > news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
> | > | Forgot to ask...how do I see if Windows is running in DOS
> | > Compatibility
> | > | Mode? I can't see it in the System Manager under any tab.
> | > Also....Thank you
> | > | for all.
> | > |
> | > | Gunilla.
> ...snip
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

cquirke
Mon Dec 15 07:21:58 CST 2003

On Sun, 14 Dec 2003 19:12:37 +0100, "Gunilla" <Gun@yahoo.com> wrote:

>I have been messing around in DOS and found out that I could run scandisk if
>I typed C:\Windows\Command and ran it from there. The other option to run it
>from C:\Windows did not work as the fault in .EXE file showed up.

Interesting - suggests there's an additional Scandisk.exe in %WinDir%
(which would run first due to Path order) that isn't normally there.
Usually there's just Scandisk.exe in Command dir and ScandiskW.exe in
the Windows dir. Have a look in the Windows dir to see if the
Scandisk.* is Scandisk.com or Scandisk.bat; that would be even more
suspicious of malware "companion" attack.

>BTW..scandisk corrected TVDebug.log as it was wrong size and
>some cluster-fault that it saved as a file0001.chk in the root but
>I don't know how to read it as Type didn't open it.

OK. The type isn't known to Scandisk as by definition, a lost cluster
chain has lost all metadata such as filename as stored in dir entry -
and Scandisk doesn't look at embedded DDE type data within the file.

>Today I tried to do another bootscan with Trend Micros Rescue Set and it
>couldn't continue as it was a error (exception...general protection fault).

>DOS/4GW error (2001): exception 0DH (general protection fault) at
>1D0:002F43FF
>TSF32:prev_tsf32 5380

Either bad code off diskette (bad diskette) or I'd suspect bad RAM,
overclocking (esp. the legacy bus the diskette runs on)

>BTW..those errors I have refeer to Explorer.exe exceptions in
>c06d007eH in module SENS.DLL on address 015f:6010857f. and also EXPLORER
>caused an invalid page fault in module KERNEL32.DLL on address 015f:bff7b9e6
>and MSIMN caused an invalid page fault in
>module MSHTMLED.DLL on address 015f:70f72931. This happens every time I
>connect to internet, even if it is 10 times each day!! I though it might be
>to help if I provide this info.

If utterly random and variable, suspect hardware. If widespread, but
not random or variable (i.e. every circumstance that crashes once
crashes every time that circumstance is reproduced) then think bit-rot
damage to file system, bad disk, or virus/cleaner damage to code.

>Ohhh, one more thing...have just attached more RAM (128 MB now). Did run two
>memory tests, Windows Test utility and MemTest and yes, even DocMem and I
>seems to be clear, or fine.

OK. Overnight 'em, preferably MemTest86 (which I suspect as being
somewhat more effective than the already-brilliant SIMMtester)

>BTW..have already scanned for Win95.Matrix virus

MTX? Yes, good call; like Magistr and CIH, files infected wiht this
may be broken after they have been cleaned by av. In fact, of the
three you will likely find MTX gives the worst mileage there.

>Sorry for the huge post! ;-))

It's OK - sounds like a huge problem, and as the man says...



>------------ ----- --- -- - - - -
Things should be made as simple as possible,
but no simpler - attrib. Albert Einstein
>------------ ----- --- -- - - - -

PCR
Mon Dec 15 17:00:55 CST 2003

Yes. I'm watching, but I guess you are in good hands already. Good luck.
Some day, make a full system backup; that's all.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Gunilla" <Gun@yahoo.com> wrote in message
news:%23qKRS4pwDHA.3216@TK2MSFTNGP11.phx.gbl...
| Hahaha...so funny you are PCR! ;-))
|
| G.
|
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:uTjNpjpwDHA.536@tk2msftngp13.phx.gbl...
| > OK, OK, I'm still here. But I'm leaving this thread for LuckyStrike
to
| > train in. I think you two are getting close to matching boots, to
see
| > whether you can find a pair. That could be a good a first step! But
you
| > will be barefoot until then; so, careful! Also, I am sure cquirke
will
| > be back.
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "Gunilla" <Gun@yahoo.com> wrote in message
| > news:uePCg3owDHA.2712@TK2MSFTNGP11.phx.gbl...
| > | Hi PCR.
| > |
| > | Thanks for the info. I am then not in a Compatibility Mode! So
nice!
| > | But Hey...why don't you stay? It's nice to be surrounded by so
many
| > nice
| > | people! ;-))
| > |
| > | Gunilla.
| > |
| > | "PCR" <pcrrcp@netzero.net> wrote in message
| > | news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
| > | > "Control Panel, System, Performance tab". If it says, "Your
system
| > is
| > | > configured for optimal performance", then you are fine. You are
not
| > in
| > | > "Compatibility Mode".
| > | >
| > | > It should look just like that in Normal Mode. (In Safe Mode, it
is
| > | > natural for it to be a bit ugly in that tab.)
| > | >
| > | > I have no intention of staying in this thread, though. Stick
with
| > | > cquirke!
| > | >
| > | > --
| > | > Thanks or Good Luck,
| > | > There may be humor in this post, and,
| > | > Naturally, you will not sue,
| > | > should things get worse after this,
| > | > PCR
| > | > pcrrcp@netzero.net
| > | > "Gunilla" <Gun@yahoo.com> wrote in message
| > | > news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
| > | > | Forgot to ask...how do I see if Windows is running in DOS
| > | > Compatibility
| > | > | Mode? I can't see it in the System Manager under any tab.
| > | > Also....Thank you
| > | > | for all.
| > | > |
| > | > | Gunilla.
| > ...snip
| >
| >
|
|
| ---
| Outgoing mail is certified Virus Free.
| Checked by AVG anti-virus system (http://www.grisoft.com).
| Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
|
|

Gunilla
Mon Dec 15 17:54:29 CST 2003

Thanks PCR, I will....I really will do that! ;-))

Gunilla.

"PCR" <pcrrcp@netzero.net> wrote in message
news:u%23hal81wDHA.2456@TK2MSFTNGP10.phx.gbl...
> Yes. I'm watching, but I guess you are in good hands already. Good luck.
> Some day, make a full system backup; that's all.
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "Gunilla" <Gun@yahoo.com> wrote in message
> news:%23qKRS4pwDHA.3216@TK2MSFTNGP11.phx.gbl...
> | Hahaha...so funny you are PCR! ;-))
> |
> | G.
> |
> | "PCR" <pcrrcp@netzero.net> wrote in message
> | news:uTjNpjpwDHA.536@tk2msftngp13.phx.gbl...
> | > OK, OK, I'm still here. But I'm leaving this thread for LuckyStrike
> to
> | > train in. I think you two are getting close to matching boots, to
> see
> | > whether you can find a pair. That could be a good a first step! But
> you
> | > will be barefoot until then; so, careful! Also, I am sure cquirke
> will
> | > be back.
> | >
> | > --
> | > Thanks or Good Luck,
> | > There may be humor in this post, and,
> | > Naturally, you will not sue,
> | > should things get worse after this,
> | > PCR
> | > pcrrcp@netzero.net
> | > "Gunilla" <Gun@yahoo.com> wrote in message
> | > news:uePCg3owDHA.2712@TK2MSFTNGP11.phx.gbl...
> | > | Hi PCR.
> | > |
> | > | Thanks for the info. I am then not in a Compatibility Mode! So
> nice!
> | > | But Hey...why don't you stay? It's nice to be surrounded by so
> many
> | > nice
> | > | people! ;-))
> | > |
> | > | Gunilla.
> | > |
> | > | "PCR" <pcrrcp@netzero.net> wrote in message
> | > | news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
> | > | > "Control Panel, System, Performance tab". If it says, "Your
> system
> | > is
> | > | > configured for optimal performance", then you are fine. You are
> not
> | > in
> | > | > "Compatibility Mode".
> | > | >
> | > | > It should look just like that in Normal Mode. (In Safe Mode, it
> is
> | > | > natural for it to be a bit ugly in that tab.)
> | > | >
> | > | > I have no intention of staying in this thread, though. Stick
> with
> | > | > cquirke!
> | > | >
> | > | > --
> | > | > Thanks or Good Luck,
> | > | > There may be humor in this post, and,
> | > | > Naturally, you will not sue,
> | > | > should things get worse after this,
> | > | > PCR
> | > | > pcrrcp@netzero.net
> | > | > "Gunilla" <Gun@yahoo.com> wrote in message
> | > | > news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
> | > | > | Forgot to ask...how do I see if Windows is running in DOS
> | > | > Compatibility
> | > | > | Mode? I can't see it in the System Manager under any tab.
> | > | > Also....Thank you
> | > | > | for all.
> | > | > |
> | > | > | Gunilla.
> | > ...snip
> | >
> | >
> |
> |
> | ---
> | Outgoing mail is certified Virus Free.
> | Checked by AVG anti-virus system (http://www.grisoft.com).
> | Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
> |
> |
>
>


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-12

LuckyStrike
Mon Dec 15 18:46:40 CST 2003

Yeah after reading what you and Quirke were discussing in a variety of
threads (My GST one maybe), I wasn't left with a whole lot of confidence in
the ability to get a clean back-up, or even how to go about achieving the
cleanest one for that matter. That was very "confidence" inspiring. Yes it
sure sounds like one's hide can be saved (cough-cough) with a back-up. :-|
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"PCR" <pcrrcp@netzero.net> wrote in message
news:u%23hal81wDHA.2456@TK2MSFTNGP10.phx.gbl...
> Yes. I'm watching, but I guess you are in good hands already. Good luck.
> Some day, make a full system backup; that's all.
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net

Gunilla
Mon Dec 15 20:30:28 CST 2003

Hi CQuirke.

I had to sort this out a little before answering, I mean trying to
understand as English is not my default language.

Lets see...I have no other scandisk then the one in C:/Windows which is
named scandskw.exe and one in C:/Windows/Command. Also one scandisk.exe and
scandisk.ini in the C:/Windows/Options/Cabs and there is also a short-cut to
the MS-DOS program of scandisk. That is what I have, no .bat or .com files
of scandisk.

So to the crashes...it is always the same ones and that are those I provided
below. Then if I understood right, it is not obviously due to hardware
problem? Is it then more likely to be a corrupted program, is that what you
mean? I have been thinking about that because it is always the same
programs...OE and Explorer.exe and eventually IE. I can run other programs,
surfing the Internet, send and receive email. The problems occur at the
start up and when connecting to Internet and then it takes away the most
applications I have in the sys.tray. but the programs are still working but
not to satisfaction.

So to viruses...have just had Html.Redlof.A virus which was taken away from
four Panda-files by Trend Micros Damage Cleanup Engine. The rest I have had
is just some parasites like Svchost32.exe, Addclass and Madfinder cleaned by
CWshredder. Amazingly I have escaped the big virus outbreaks. Never even
receive a spam or false patches. But who knows really...I can have something
that is hiding.

Tonight I will do a test as you said. Tomorrow I will tell you how it worked
out. I have to ask...if nothing can solve this problem, do you suggest a
total un-installation of the programs involved or maybe even a re-format of
the HD?

Thanks for all.

Regards / Gunilla.



ScandskW.exe
"cquirke (MVP Win9x)" <name.goes.here@nospam.iafrica.com> wrote in message
news:5v9rtv0qtpledsujl6areai6rp8p2pjs0m@4ax.com...
> On Sun, 14 Dec 2003 19:12:37 +0100, "Gunilla" <Gun@yahoo.com> wrote:
>
> >I have been messing around in DOS and found out that I could run scandisk
if
> >I typed C:\Windows\Command and ran it from there. The other option to run
it
> >from C:\Windows did not work as the fault in .EXE file showed up.
>
> Interesting - suggests there's an additional Scandisk.exe in %WinDir%
> (which would run first due to Path order) that isn't normally there.
> Usually there's just Scandisk.exe in Command dir and ScandiskW.exe in
> the Windows dir. Have a look in the Windows dir to see if the
> Scandisk.* is Scandisk.com or Scandisk.bat; that would be even more
> suspicious of malware "companion" attack.
>
> >BTW..scandisk corrected TVDebug.log as it was wrong size and
> >some cluster-fault that it saved as a file0001.chk in the root but
> >I don't know how to read it as Type didn't open it.
>
> OK. The type isn't known to Scandisk as by definition, a lost cluster
> chain has lost all metadata such as filename as stored in dir entry -
> and Scandisk doesn't look at embedded DDE type data within the file.
>
> >Today I tried to do another bootscan with Trend Micros Rescue Set and it
> >couldn't continue as it was a error (exception...general protection
fault).
>
> >DOS/4GW error (2001): exception 0DH (general protection fault) at
> >1D0:002F43FF
> >TSF32:prev_tsf32 5380
>
> Either bad code off diskette (bad diskette) or I'd suspect bad RAM,
> overclocking (esp. the legacy bus the diskette runs on)
>
> >BTW..those errors I have refeer to Explorer.exe exceptions in
> >c06d007eH in module SENS.DLL on address 015f:6010857f. and also EXPLORER
> >caused an invalid page fault in module KERNEL32.DLL on address
015f:bff7b9e6
> >and MSIMN caused an invalid page fault in
> >module MSHTMLED.DLL on address 015f:70f72931. This happens every time I
> >connect to internet, even if it is 10 times each day!! I though it might
be
> >to help if I provide this info.
>
> If utterly random and variable, suspect hardware. If widespread, but
> not random or variable (i.e. every circumstance that crashes once
> crashes every time that circumstance is reproduced) then think bit-rot
> damage to file system, bad disk, or virus/cleaner damage to code.
>
> >Ohhh, one more thing...have just attached more RAM (128 MB now). Did run
two
> >memory tests, Windows Test utility and MemTest and yes, even DocMem and I
> >seems to be clear, or fine.
>
> OK. Overnight 'em, preferably MemTest86 (which I suspect as being
> somewhat more effective than the already-brilliant SIMMtester)
>
> >BTW..have already scanned for Win95.Matrix virus
>
> MTX? Yes, good call; like Magistr and CIH, files infected wiht this
> may be broken after they have been cleaned by av. In fact, of the
> three you will likely find MTX gives the worst mileage there.
>
> >Sorry for the huge post! ;-))
>
> It's OK - sounds like a huge problem, and as the man says...
>
>
>
> >------------ ----- --- -- - - - -
> Things should be made as simple as possible,
> but no simpler - attrib. Albert Einstein
> >------------ ----- --- -- - - - -


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11

PCR
Mon Dec 15 19:55:37 CST 2003

OK. One thing: Don't tell cquirke I suggested it. He'd rather I climb
into the FAT & find out where the clusters should be pointing! Careful
he doesn't put you in there, Gunilla!

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"Gunilla" <Gun@yahoo.com> wrote in message
news:ebUbNb2wDHA.3744@TK2MSFTNGP11.phx.gbl...
| Thanks PCR, I will....I really will do that! ;-))
|
| Gunilla.
|
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:u%23hal81wDHA.2456@TK2MSFTNGP10.phx.gbl...
| > Yes. I'm watching, but I guess you are in good hands already. Good
luck.
| > Some day, make a full system backup; that's all.
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "Gunilla" <Gun@yahoo.com> wrote in message
| > news:%23qKRS4pwDHA.3216@TK2MSFTNGP11.phx.gbl...
| > | Hahaha...so funny you are PCR! ;-))
| > |
| > | G.
| > |
| > | "PCR" <pcrrcp@netzero.net> wrote in message
| > | news:uTjNpjpwDHA.536@tk2msftngp13.phx.gbl...
| > | > OK, OK, I'm still here. But I'm leaving this thread for
LuckyStrike
| > to
| > | > train in. I think you two are getting close to matching boots,
to
| > see
| > | > whether you can find a pair. That could be a good a first step!
But
| > you
| > | > will be barefoot until then; so, careful! Also, I am sure
cquirke
| > will
| > | > be back.
| > | >
| > | > --
| > | > Thanks or Good Luck,
| > | > There may be humor in this post, and,
| > | > Naturally, you will not sue,
| > | > should things get worse after this,
| > | > PCR
| > | > pcrrcp@netzero.net
| > | > "Gunilla" <Gun@yahoo.com> wrote in message
| > | > news:uePCg3owDHA.2712@TK2MSFTNGP11.phx.gbl...
| > | > | Hi PCR.
| > | > |
| > | > | Thanks for the info. I am then not in a Compatibility Mode! So
| > nice!
| > | > | But Hey...why don't you stay? It's nice to be surrounded by so
| > many
| > | > nice
| > | > | people! ;-))
| > | > |
| > | > | Gunilla.
| > | > |
| > | > | "PCR" <pcrrcp@netzero.net> wrote in message
| > | > | news:OQSVDlowDHA.1736@TK2MSFTNGP09.phx.gbl...
| > | > | > "Control Panel, System, Performance tab". If it says, "Your
| > system
| > | > is
| > | > | > configured for optimal performance", then you are fine. You
are
| > not
| > | > in
| > | > | > "Compatibility Mode".
| > | > | >
| > | > | > It should look just like that in Normal Mode. (In Safe Mode,
it
| > is
| > | > | > natural for it to be a bit ugly in that tab.)
| > | > | >
| > | > | > I have no intention of staying in this thread, though. Stick
| > with
| > | > | > cquirke!
| > | > | >
| > | > | > --
| > | > | > Thanks or Good Luck,
| > | > | > There may be humor in this post, and,
| > | > | > Naturally, you will not sue,
| > | > | > should things get worse after this,
| > | > | > PCR
| > | > | > pcrrcp@netzero.net
| > | > | > "Gunilla" <Gun@yahoo.com> wrote in message
| > | > | > news:uaLYd$mwDHA.1760@TK2MSFTNGP10.phx.gbl...
| > | > | > | Forgot to ask...how do I see if Windows is running in DOS
| > | > | > Compatibility
| > | > | > | Mode? I can't see it in the System Manager under any tab.
| > | > | > Also....Thank you
| > | > | > | for all.
| > | > | > |
| > | > | > | Gunilla.
| > | > ...snip
| > | >
| > | >
| > |
| > |
| > | ---
| > | Outgoing mail is certified Virus Free.
| > | Checked by AVG anti-virus system (http://www.grisoft.com).
| > | Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-11
| > |
| > |
| >
| >
|
|
| ---
| Outgoing mail is certified Virus Free.
| Checked by AVG anti-virus system (http://www.grisoft.com).
| Version: 6.0.551 / Virus Database: 343 - Release Date: 2003-12-12
|
|

PCR
Tue Dec 16 03:52:02 CST 2003

You're making me think I should renew my full system backup real quick,
by reminding of those threads. Either that, or I'd better prepare for a
jaunt into the FAT.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote in message news:e4seU42wDHA.1396@TK2MSFTNGP10.phx.gbl...
| Yeah after reading what you and Quirke were discussing in a variety of
| threads (My GST one maybe), I wasn't left with a whole lot of
confidence in
| the ability to get a clean back-up, or even how to go about achieving
the
| cleanest one for that matter. That was very "confidence" inspiring.
Yes it
| sure sounds like one's hide can be saved (cough-cough) with a back-up.
:-|
| --
|
| LuckyStrike
| LS@smokedamagedfurniture.youcandriveitawaytoday.com
| --------------------------------------------------------------------
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:u%23hal81wDHA.2456@TK2MSFTNGP10.phx.gbl...
| > Yes. I'm watching, but I guess you are in good hands already. Good
luck.
| > Some day, make a full system backup; that's all.
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
|
|

LuckyStrike
Tue Dec 16 04:08:26 CST 2003

Well when you find a foolproof (or LS proof) way, let me know, 'cause that
thread with the two of you made it all seem so futile. You hear it said all
the time "back-up, back-up, back-up" but it seems mighty flawed on the large
scale. Localized, specific, and limited might work without introducing
elements that are weak? There's a strong chance that I probably misconstrued
the import of the message though.
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"PCR" <pcrrcp@netzero.net> wrote in message
news:emnJeo7wDHA.2308@TK2MSFTNGP11.phx.gbl...
> You're making me think I should renew my full system backup real quick,
> by reminding of those threads. Either that, or I'd better prepare for a
> jaunt into the FAT.
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
> wrote in message news:e4seU42wDHA.1396@TK2MSFTNGP10.phx.gbl...
> | Yeah after reading what you and Quirke were discussing in a variety of
> | threads (My GST one maybe), I wasn't left with a whole lot of
> confidence in
> | the ability to get a clean back-up, or even how to go about achieving
> the
> | cleanest one for that matter. That was very "confidence" inspiring.
> Yes it
> | sure sounds like one's hide can be saved (cough-cough) with a back-up.
> :-|
> | --
> | LuckyStrike
> | LS@smokedamagedfurniture.youcandriveitawaytoday.com
> | --------------------------------------------------------------------

PCR
Tue Dec 16 05:05:43 CST 2003

No, that thread isn't about backups. It's about repairing the hard
drive, when you do not have a reliable backup to run to. Then, you need
to understand the FAT. Better get a good backup app, before it is too
late! Make one backup when all is well & never touch it again. That way,
if a flaw later develops and gets put into your regular full system
backups, you will always the older one to run to.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote in message news:uAPOPy7wDHA.1060@TK2MSFTNGP12.phx.gbl...
| Well when you find a foolproof (or LS proof) way, let me know, 'cause
that
| thread with the two of you made it all seem so futile. You hear it
said all
| the time "back-up, back-up, back-up" but it seems mighty flawed on the
large
| scale. Localized, specific, and limited might work without introducing
| elements that are weak? There's a strong chance that I probably
misconstrued
| the import of the message though.
| --
|
| LuckyStrike
| LS@smokedamagedfurniture.youcandriveitawaytoday.com
| --------------------------------------------------------------------
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:emnJeo7wDHA.2308@TK2MSFTNGP11.phx.gbl...
| > You're making me think I should renew my full system backup real
quick,
| > by reminding of those threads. Either that, or I'd better prepare
for a
| > jaunt into the FAT.
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
| > wrote in message news:e4seU42wDHA.1396@TK2MSFTNGP10.phx.gbl...
| > | Yeah after reading what you and Quirke were discussing in a
variety of
| > | threads (My GST one maybe), I wasn't left with a whole lot of
| > confidence in
| > | the ability to get a clean back-up, or even how to go about
achieving
| > the
| > | cleanest one for that matter. That was very "confidence"
inspiring.
| > Yes it
| > | sure sounds like one's hide can be saved (cough-cough) with a
back-up.
| > :-|
| > | --
| > | LuckyStrike
| > | LS@smokedamagedfurniture.youcandriveitawaytoday.com
| >
| --------------------------------------------------------------------
|
|

glee
Wed Dec 17 06:27:25 CST 2003

"Gunilla" <Gun@yahoo.com> wrote in message =
news:eujw29WwDHA.536@tk2msftngp13.phx.gbl...
Can I ask you one more thing...what is the
> command for copy the text in DOS and later paste it in to for example
> Notepad? Sorry, but I am just hopeless to know how to do. :-(

Gunilla, you can also redirect the output of most DOS commands to go to =
a text file directly.
For example, the DIR command.....
DIR /a > c:\windows\desktop\dirlist.txt
will put the DIR listing of whatever folder you are doing into a text =
file named dirlist.txt, on your desktop.

If you want to do a bunch of DIR's and add them all to the same text =
file, use ">>"
DIR /a >> c:\windows\desktop\dirlist.txt
--=20
Glen Ventura, MS MVP W95/98 Systems
http://dts-l.org/goodpost.htm

Gunilla
Wed Dec 17 12:52:49 CST 2003

Oh Glen...thank you so much. I knew it was something but forget how to do
it. I did a .txt folder from DOS with the command "md" but didn't know how
to put things in there from DOS. Thank you! ;-))

Gunilla.

"glee" <glee29@spamindspring.com> wrote in message
news:eSJ%23AkJxDHA.2436@TK2MSFTNGP09.phx.gbl...
"Gunilla" <Gun@yahoo.com> wrote in message
news:eujw29WwDHA.536@tk2msftngp13.phx.gbl...
Can I ask you one more thing...what is the
> command for copy the text in DOS and later paste it in to for example
> Notepad? Sorry, but I am just hopeless to know how to do. :-(

Gunilla, you can also redirect the output of most DOS commands to go to a
text file directly.
For example, the DIR command.....
DIR /a > c:\windows\desktop\dirlist.txt
will put the DIR listing of whatever folder you are doing into a text file
named dirlist.txt, on your desktop.

If you want to do a bunch of DIR's and add them all to the same text file,
use ">>"
DIR /a >> c:\windows\desktop\dirlist.txt
--
Glen Ventura, MS MVP W95/98 Systems
http://dts-l.org/goodpost.htm




---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.552 / Virus Database: 344 - Release Date: 2003-12-15

LuckyStrike
Fri Dec 19 15:45:08 CST 2003

It was so confusing I obviously hadn't made heads nor tails out of it. :-)
Too late for a flawless backup; the PC is a year old (almost) and is no
longer a virgin. :-\
--
LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"PCR" <pcrrcp@netzero.net> wrote in message
news:usEjS%23AxDHA.2452@tk2msftngp13.phx.gbl...
> No, that thread isn't about backups. It's about repairing the hard
> drive, when you do not have a reliable backup to run to. Then, you need
> to understand the FAT. Better get a good backup app, before it is too
> late! Make one backup when all is well & never touch it again. That way,
> if a flaw later develops and gets put into your regular full system
> backups, you will always the older one to run to.
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net

PCR
Fri Dec 19 18:30:59 CST 2003

Yea, me too. But that's the way to do it next time!

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote in message news:OO8xilnxDHA.2340@TK2MSFTNGP12.phx.gbl...
| It was so confusing I obviously hadn't made heads nor tails out of it.
:-)
| Too late for a flawless backup; the PC is a year old (almost) and is
no
| longer a virgin. :-\
| --
| LuckyStrike
| LS@smokedamagedfurniture.youcandriveitawaytoday.com
| --------------------------------------------------------------------
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:usEjS%23AxDHA.2452@tk2msftngp13.phx.gbl...
| > No, that thread isn't about backups. It's about repairing the hard
| > drive, when you do not have a reliable backup to run to. Then, you
need
| > to understand the FAT. Better get a good backup app, before it is
too
| > late! Make one backup when all is well & never touch it again. That
way,
| > if a flaw later develops and gets put into your regular full system
| > backups, you will always the older one to run to.
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
|
|

LuckyStrike
Fri Dec 19 20:01:17 CST 2003

"Next time" said PCR! LOL! If my aunt had b**** she'd be my uncle! (But you
are right. Maybe I'll get a second chance.)
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"PCR" <pcrrcp@netzero.net> wrote in message
news:%23XnCfBpxDHA.3216@TK2MSFTNGP11.phx.gbl...
> Yea, me too. But that's the way to do it next time!
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net
> "LuckyStrike" wrote:
> | Too late for a flawless backup; the PC is a year old (almost) and is
> no longer a virgin. :-\
> | --
> | LuckyStrike
> | --------------------------------------------------------------------

PCR
Fri Dec 19 21:16:10 CST 2003

Yea. I did my QuickRestore Full Restore from a double set of CDs once,
&, by Dundat!, if I have to, I will do it again! After that, it's an
immediate full system backup for me. No one should ever have to go
through the six to eight reboots of that thing-- even twice, really.
Hopefully, I won't have to make the phone calls this time, but my notes
on the process were done under great stress. It certainly didn't go like
the instructions said!

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote in message news:ukPPr0pxDHA.3436@tk2msftngp13.phx.gbl...
| "Next time" said PCR! LOL! If my aunt had b**** she'd be my uncle!
(But you
| are right. Maybe I'll get a second chance.)
| --
|
| LuckyStrike
| LS@smokedamagedfurniture.youcandriveitawaytoday.com
| --------------------------------------------------------------------
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:%23XnCfBpxDHA.3216@TK2MSFTNGP11.phx.gbl...
| > Yea, me too. But that's the way to do it next time!
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
| > "LuckyStrike" wrote:
| > | Too late for a flawless backup; the PC is a year old (almost) and
is
| > no longer a virgin. :-\
| > | --
| > | LuckyStrike
| >
| --------------------------------------------------------------------
|
|

LuckyStrike
Sat Dec 20 19:40:54 CST 2003

Never does go as planned, but as long as success was achieved, that's the
bottom line. A good bottom line I might add. I won't be that....uh....lucky!
heh.

If we continue to lurk around, we may end up larnin' sumthin'. ;-))
--

LuckyStrike
LS@smokedamagedfurniture.youcandriveitawaytoday.com
--------------------------------------------------------------------
"PCR" <pcrrcp@netzero.net> wrote in message
news:e1PEzdqxDHA.536@tk2msftngp13.phx.gbl...
> Yea. I did my QuickRestore Full Restore from a double set of CDs once,
> &, by Dundat!, if I have to, I will do it again! After that, it's an
> immediate full system backup for me. No one should ever have to go
> through the six to eight reboots of that thing-- even twice, really.
> Hopefully, I won't have to make the phone calls this time, but my notes
> on the process were done under great stress. It certainly didn't go like
> the instructions said!
>
> --
> Thanks or Good Luck,
> There may be humor in this post, and,
> Naturally, you will not sue,
> should things get worse after this,
> PCR
> pcrrcp@netzero.net

PCR
Sat Dec 20 21:17:24 CST 2003

Absolutely, & yes, indeed, it DID work.

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR
pcrrcp@netzero.net
"LuckyStrike" <LS@smokedamagedfurniture.youcandriveitawaytoday.com>
wrote in message news:O4Uo6N2xDHA.2360@TK2MSFTNGP10.phx.gbl...
| Never does go as planned, but as long as success was achieved, that's
the
| bottom line. A good bottom line I might add. I won't be
that....uh....lucky!
| heh.
|
| If we continue to lurk around, we may end up larnin' sumthin'. ;-))
| --
|
| LuckyStrike
| LS@smokedamagedfurniture.youcandriveitawaytoday.com
| --------------------------------------------------------------------
| "PCR" <pcrrcp@netzero.net> wrote in message
| news:e1PEzdqxDHA.536@tk2msftngp13.phx.gbl...
| > Yea. I did my QuickRestore Full Restore from a double set of CDs
once,
| > &, by Dundat!, if I have to, I will do it again! After that, it's an
| > immediate full system backup for me. No one should ever have to go
| > through the six to eight reboots of that thing-- even twice, really.
| > Hopefully, I won't have to make the phone calls this time, but my
notes
| > on the process were done under great stress. It certainly didn't go
like
| > the instructions said!
| >
| > --
| > Thanks or Good Luck,
| > There may be humor in this post, and,
| > Naturally, you will not sue,
| > should things get worse after this,
| > PCR
| > pcrrcp@netzero.net
|
|